How Firewalls Work: Types, Real Examples & How They Block Attacks (2026)
What is a Firewall? Types, How It Works & Why You Need One (Complete 2026 Guide)
Every day, your home router silently blocks thousands of connection attempts. Port scanners probing for open services. Bots checking whether your device is running a vulnerable version of a protocol. Automated scripts testing default credentials. You never see this activity — your firewall handles it before any of it reaches your devices.
At the enterprise level, next-generation firewalls process billions of packets per day, applying hundreds of rules in microseconds, blocking exploit attempts, identifying malware command-and-control traffic, and enforcing policies about which applications employees can use and which websites they can visit — all while adding imperceptible latency to legitimate traffic.
A firewall is one of the most fundamental components of any security architecture. Yet most people who rely on one daily have only the vaguest idea of what it actually does. This guide explains exactly how every type of firewall works, what each one is designed to stop, and — critically — what none of them can stop on their own.
- What a firewall is — the core concept and the security guard analogy
- How firewalls work — packets, rules, and decision logic
- Every firewall type explained — from packet filtering to NGFW
- Web Application Firewalls (WAF) — protecting applications, not networks
- Cloud firewalls and Firewall-as-a-Service
- Real firewall rules — what they actually look like
- What firewalls protect against — and what they don't
- Firewall vs antivirus — why you need both
- Firewall best practices for 2026
What a Firewall Is — The Security Guard Analogy
A firewall is a network security system — hardware, software, or cloud-based — that monitors and controls all incoming and outgoing network traffic according to a defined set of security rules. It sits between your network (or device) and external networks, deciding which data is allowed through and which is blocked.
The security guard analogy is accurate but incomplete. A better analogy is a customs checkpoint at an international border. Every vehicle (data packet) attempting to cross is examined. Some have pre-approved permits (established connections from trusted sources). Some are carrying prohibited goods (malicious payloads). Some have suspicious documentation (spoofed source addresses). The customs officer applies a rulebook — allow this, block that, inspect this further, log everything — and makes a decision in seconds for every vehicle.
Firewalls do this for every data packet crossing your network boundary — not seconds per vehicle, but microseconds per packet, for millions of packets per second. The rulebook is your firewall policy, which you configure based on what traffic should be allowed and what should be blocked.
How Firewalls Work — Packets, Rules, and Decision Logic
All internet communication is broken into small chunks called packets. Each packet has a header (metadata: source IP, destination IP, source port, destination port, protocol, flags) and a payload (the actual content). A firewall examines some or all of this information to make its allow/deny decision.
Firewall rules are evaluated in order from top to bottom. The first rule that matches the packet is applied. If no rule matches, the default action (typically deny all) applies. This ordering matters — a broad "allow all" rule near the top of a ruleset can negate specific blocking rules below it.
In this ruleset, Rule 4 blocking RDP (port 3389) from the internet is critical — exposed RDP is the #1 entry point for ransomware attacks, as documented in the ransomware guide. Rule 3 blocking external access to the database server ensures that even if the web server is compromised, the attacker cannot directly reach the database from outside.
Every Firewall Type Explained
Packet Filtering Firewall
The original and simplest firewall type. Examines each packet in isolation, comparing its header information (source/destination IP, port, protocol) against a ruleset. Makes a simple binary decision: allow or deny. Does not track connection state — treats each packet independently, with no memory of previous packets.
Stateful Inspection Firewall
Tracks the state of active connections in a state table. Understands that a TCP connection involves a three-way handshake and that packets should arrive in a specific sequence. Can verify that an incoming packet is a legitimate response to an outbound request, not an unsolicited inbound connection. This is the foundation of the firewalls built into every modern router and operating system.
When your browser requests a web page, the firewall records this outbound connection. When the web server's response arrives, the firewall sees it as a legitimate response to an established connection and allows it. If someone outside your network tries to send data to your browser directly (without you having made a request), the firewall blocks it — there is no matching entry in the state table.
Next-Generation Firewall (NGFW)
The current enterprise standard, combining stateful inspection with deep packet inspection (DPI), application awareness, intrusion prevention (IPS), SSL/TLS traffic inspection, user identity awareness, and threat intelligence integration. An NGFW can identify the specific application generating traffic — not just the port and protocol. It can distinguish Zoom video calls from BitTorrent file sharing even if both use the same port, and apply different policies to each.
NGFWs decrypt SSL/TLS traffic, inspect the payload for malicious content (malware signatures, exploit attempts, data exfiltration), then re-encrypt it before forwarding. This is how they detect ransomware C2 communication that uses HTTPS to blend in with normal traffic — the type of fileless malware communication described in the malware guide.
Proxy Firewall (Application Gateway)
Acts as an intermediary — instead of forwarding traffic directly, it accepts the connection from the client, makes a new connection to the destination on the client's behalf, and passes traffic between them. This complete traffic interception allows deep content inspection but introduces latency. Used where maximum inspection is needed, particularly for outbound web traffic control. Modern proxy firewalls are typically integrated into NGFW platforms rather than deployed separately.
Web Application Firewalls (WAF) — Protecting Applications, Not Networks
A Web Application Firewall operates at Layer 7 (the application layer) and specifically protects web applications and APIs from application-level attacks. Unlike network firewalls that examine IP addresses and ports, a WAF examines the content of HTTP/HTTPS requests — URLs, parameters, headers, cookies, and request bodies — for attack patterns.
WAFs protect against the vulnerabilities in the OWASP Top 10: SQL injection attempts (detecting ' OR 1=1-- patterns in query parameters), XSS payloads (detecting <script> tags in user input), path traversal attempts (detecting ../../ in file path parameters), and application-layer DDoS patterns.
| Feature | Network Firewall / NGFW | Web Application Firewall (WAF) |
|---|---|---|
| Operates at | Network Layer (L3/L4) or App Layer (L7) | Application Layer (L7) only |
| Protects against | Unauthorised network access, port scans, protocol attacks | SQLi, XSS, CSRF, OWASP Top 10, API abuse |
| Traffic it inspects | All protocols and ports | HTTP/HTTPS only |
| Where deployed | Network perimeter, between network segments | In front of web servers and APIs |
| Examples | Cisco ASA, Palo Alto, Fortinet FortiGate | Cloudflare WAF, AWS WAF, ModSecurity |
| Required for compliance | PCI DSS network security requirements | PCI DSS Requirement 6.6 (web application protection) |
WAFs are essential for any business running web applications. Without one, SQL injection attacks — the most exploited web vulnerability as covered in the SQL injection guide — can succeed even against a perfectly configured network firewall, because the attack arrives as valid HTTP traffic on port 443.
Cloud Firewalls and Firewall-as-a-Service
Cloud firewalls (also called Firewall-as-a-Service, FWaaS) are delivered as cloud services rather than physical appliances or software installed on-premises. They protect cloud workloads, remote users, and distributed organisations where there is no single network perimeter to defend. The FWaaS market was $2.9 billion in 2024 and is growing at 22% annually — driven by the reality that 94% of enterprises now use cloud services.
Providers like Cloudflare, Zscaler, and Palo Alto Networks (Prisma Access) deliver NGFW capabilities from the cloud — including deep packet inspection, application awareness, and threat intelligence — for users and workloads anywhere in the world, without requiring traffic to backhaul through a central office. This is the firewall model that suits Zero Trust architecture, covered in depth in the Zero Trust guide.
What Firewalls Protect Against — And What They Don't
What Firewalls Cannot Stop — Understanding the Limits
- Phishing and social engineering. A firewall cannot prevent an employee from clicking a malicious link in an email and entering their credentials on a phishing site — the HTTPS traffic to the phishing site looks identical to HTTPS traffic to a legitimate site, and the user action happens voluntarily. This is why phishing remains the #1 attack vector despite widespread firewall deployment.
- Malware delivered via email attachments. If an employee opens a malicious Word document attachment that executes a macro, the firewall cannot stop the initial execution — it happened inside the trusted network. The firewall may detect the subsequent C2 communication, but it cannot prevent the initial infection.
- Authorised but malicious traffic from compromised accounts. A firewall that allows HTTPS traffic to business applications cannot distinguish between a legitimate employee using their account and an attacker who has stolen that employee's credentials. Once credentials are compromised (as covered in the dark web guide), the access looks legitimate to a firewall.
- Insider threats. A malicious employee with legitimate network access can exfiltrate data over allowed connections. Firewalls designed to keep attackers out cannot stop authorised users behaving maliciously.
- Zero-day exploits in allowed applications. If a firewall permits HTTPS traffic to a specific web application, and that application has a zero-day vulnerability, the attack arrives through the allowed HTTPS channel. The firewall cannot know about the vulnerability before the vendor does.
- Encrypted malware traffic over allowed ports. Modern malware uses HTTPS to communicate with C2 servers — the same encryption your browser uses. NGFWs can break SSL/TLS inspection to examine this traffic, but standard firewalls cannot.
Firewall Best Practices for 2026
Firewall Configuration Checklist
- Apply the default-deny principle. Block all traffic by default, then explicitly permit only what is necessary. Never use default-allow. Review your ruleset for overly permissive rules like "allow any any any" which are alarmingly common in misconfigured environments.
- Block RDP (port 3389), SMB (ports 445/139), and SSH (port 22) from the internet. These are the top three services used by ransomware for initial access. If remote access to these services is genuinely needed, require it to go through a VPN with MFA rather than exposing the service directly.
- Expose only what is necessary. For a web server that only needs to serve HTTP/HTTPS, only ports 80 and 443 should be accessible from the internet. Every open port is a potential attack surface.
- Enable logging and review logs regularly. A firewall that is not monitored is a firewall that is not working for you. Firewall logs reveal blocked connection attempts (useful for spotting scanning and reconnaissance), unexpected allowed traffic, and anomalous patterns that may indicate a compromise. This directly supports detecting the early stages of attacks like those described in the vulnerability discovery guide.
- Segment your network. Place the database server on a separate network segment from the web server. Place backup systems on a segment with no inbound access from other segments. If ransomware compromises the web server, segmentation limits lateral movement and protects backups — exactly the defences described in the ransomware protection section.
- Use a WAF for any web-facing application. A network firewall cannot protect against SQLi, XSS, CSRF, and the other OWASP Top 10 vulnerabilities. A WAF is the correct tool for application-layer protection and should be considered mandatory for any public-facing web application or API.
- Audit your firewall rules quarterly. Rules accumulate over time and many become outdated — services that were decommissioned years ago but their firewall rules remain. Outdated rules create unnecessary attack surface. A quarterly ruleset review should remove any rule that is no longer needed.
- Keep firewall firmware/software updated. Firewall appliances themselves have vulnerabilities — Fortinet, Palo Alto, and Cisco firewalls have all had critical CVEs in recent years. Attackers actively scan for unpatched firewall management interfaces. Apply security updates as a priority, as covered in the security misconfiguration guide.
Comments
Post a Comment