English
Menu

What is Firewall?

A mechanism (a device or software), usually placed at a network boundary, that passes only traffic allowed by predefined rules and blocks everything else. It decides by source and destination IP addresses, port numbers, protocol, direction of traffic and so on. Its main job is to protect an internal network from unauthorized connections from the internet.

Japanese name: ファイアウォール

Firewall appears in 5 practice questions across 3 topics, including Cyber Attacks and Defense in Practice, Cloud and Container Basics, Computer Networking Basics.

Field: Information Security Basics

Packet filtering and stateful inspection

Basic packet filtering compares each packet's header with a list of rules from the top and passes or drops the packet according to the first rule that matches. Traffic that matches no rule is dropped as a matter of principle (default deny). Stateful inspection remembers the state of each connection, including which side started it; it automatically lets in return traffic for connections started from inside and drops unsolicited traffic from outside. Products that also identify applications from traffic content or integrate intrusion prevention are called next-generation firewalls.

Placement and the DMZ

A firewall is normally placed where the internet meets the internal network. Servers that outsiders must reach, such as web and mail servers, go in a separate zone called the DMZ (demilitarized zone). Only the necessary ports are opened from the internet to the DMZ, nothing is allowed from the internet to the internal network, and traffic from the DMZ to the internal network is restricted. That way, even if a public server is taken over, the damage is less likely to spread inside. Besides boundary devices, host-based firewalls run on each PC and server.

What a firewall alone cannot stop

If port 443 is open for a website, SQL injection or cross-site scripting hidden in that traffic gets through, so a WAF that inspects the content is needed. A firewall also cannot stop an internal device infected through an email attachment or phishing, or an intruder who logs in through the VPN with valid credentials. Defenses therefore combine intrusion detection and prevention (IDS/IPS), EDR to watch endpoints, and zero trust, which verifies every access.

Try it: questions about Firewall

Which correctly describes the basic function of a (packet-filtering) firewall?

  1. AIt encrypts communication to prevent eavesdropping along the path
  2. BIt passes only permitted traffic and blocks the rest, according to rules based on source and destination IP addresses, port numbers and so on
  3. CIt distributes incoming packets among several servers to spread the processing load
Show answer and explanation

Answer: B. It passes only permitted traffic and blocks the rest, according to rules based on source and destination IP addresses, port numbers and so on

A firewall is placed, for example, at the boundary between an internal network and the internet, and allows or denies traffic according to predefined rules. A typical setting is "from outside, allow only traffic to port 443 of the public web server and deny all other incoming connections." Most firewalls today perform stateful inspection, keeping track of connection state and automatically letting through the return packets of connections started from inside. They do not encrypt, so they are combined with TLS or a VPN to protect traffic. They also cannot stop attacks that come through an allowed port (such as those exploiting web application vulnerabilities), so other measures such as a WAF are used as well.

FAQ

What is the difference between a firewall and a WAF?

A firewall decides which traffic to pass mainly by IP addresses and port numbers. A WAF (web application firewall) inspects the content of permitted web traffic, the HTTP requests, and blocks attacks such as SQL injection. They protect different layers, so they are used together.

Do I still need antivirus if I have a firewall?

Yes. A firewall passes the traffic it allows, so it cannot stop malware arriving through web browsing or email. It has to be combined with endpoint malware protection or EDR and with software updates.

Firewall in the explanations

Questions that mention Firewall (5)

  1. A container is started with the command above from the image nginx, a web server that listens on port 80. The host's IP address is 192.0.2.10, and there are no restrictions such as a firewall. Which of the following is the URL to use to reach this web server from a browser on another PC on the same network?
  2. Which correctly describes the basic function of a (packet-filtering) firewall?
  3. Which of the following is the most appropriate control for making "lateral movement" difficult, that is, the spread of a compromise from one hijacked employee PC to other PCs and servers inside the company?
  4. Which of the following correctly matches SIEM, SOAR and SOC with their roles in security monitoring?
  5. Which of the following correctly describes a WAF (web application firewall)?

Books on Information Security Basics Ad

As an Amazon Associate I earn from qualifying purchases.

Comparisons that include this term

Related terms

IP address URL (Uniform Resource Locator) WAF (web application firewall) Container Packet TLS VPN (virtual private network) Lateral movement SIEM (security information and event management) EDR (endpoint detection and response)

Back to the glossary