What is a Network Firewall and How Does it Work?

A network firewall is a security system that monitors and controls incoming and outgoing network traffic based on a set of security rules. It can help prevent unauthorized connections, limit access to network resources, and reduce the risk of certain cyberattacks.

Firewalls can be built into network hardware, installed as software, or provided as a combination of hardware and software. They can protect home networks, business networks, individual devices, servers, and other connected systems.

In simple terms, a firewall acts as a gatekeeper between trusted and untrusted networks. It examines network traffic and determines whether that traffic should be allowed or blocked.

Firewalls remain an important part of a layered security strategy as more computers, mobile devices, smart home products, and other connected devices access the internet.

What does a firewall do?

A firewall monitors network traffic and applies predefined security rules to decide what traffic can pass through.

Depending on the firewall and its configuration, it may:

• Allow or block network connections.
• Control access based on IP addresses and ports.
• Track active network connections.
• Inspect network traffic for suspicious activity.
• Restrict access to specific websites, services, or applications.
• Segment networks to limit communication between systems.
• Log network activity for security monitoring and troubleshooting.

A firewall does not automatically protect against every type of cyber threat. For example, it cannot replace antivirus or endpoint protection, software updates, strong passwords, multifactor authentication, or safe browsing habits.

Instead, a firewall provides an important layer of protection by controlling network traffic.

What are the different types of firewalls?

There are several types of firewall technologies. Modern security products often combine multiple approaches rather than relying on only one.

1. Packet-filtering firewall

A packet-filtering firewall examines information in individual network packets to determine whether they should be allowed or blocked.

Rules can be based on information such as:

• Source IP address
• Destination IP address
• Network protocol
• Source port
• Destination port

For example, a firewall could be configured to block traffic from a particular IP address or prevent access to a specific network port.

Packet filtering is relatively simple and can be efficient, but it provides limited visibility into the actual contents or context of network traffic.

2. Stateful inspection firewall

A stateful firewall tracks the state of active network connections. Instead of evaluating each packet completely independently, it can determine whether a packet belongs to an established and legitimate connection.

For example, if a device on your network starts a connection to an approved website, a stateful firewall can track that connection and allow appropriate response traffic back to the device.

Stateful inspection provides more context than basic packet filtering and is commonly used in modern network firewalls. NIST describes stateful inspection as a firewall capability that maintains information about connections passing through the firewall and uses that information when filtering traffic.

3. Proxy firewall

A proxy firewall acts as an intermediary between a client and the destination system. Instead of allowing the two systems to communicate directly, the firewall establishes separate connections and passes approved traffic between them.

Because the proxy sits between the two systems, it can inspect traffic at a higher level than basic packet filtering.

Proxy firewalls can provide additional control and visibility, although inspecting traffic at a deeper level can require more processing and may affect performance.

4. Next-generation firewall (NGFW)

A next-generation firewall (NGFW) combines traditional firewall capabilities with additional security features.

Depending on the product, an NGFW may include capabilities such as:

• Stateful traffic inspection
• Application identification and control
• Intrusion prevention
• User or identity-based policies
• Threat intelligence
• Malware detection
• Encrypted traffic inspection

NGFWs are commonly used in business and enterprise environments where organizations need more detailed control and visibility into network traffic.

5. Web Application Firewall (WAF)

A Web Application Firewall (WAF) is designed specifically to protect web applications. Rather than primarily controlling general network connections, a WAF examines HTTP or HTTPS requests sent to web applications.

A WAF can help identify and block certain malicious requests, including common web attacks such as:

• SQL injection
• Cross-site scripting (XSS)
• Malicious HTTP requests

A WAF can be deployed in front of a web application, on a server, or through a cloud-based service. OWASP notes that WAFs are designed to protect web applications and can inspect HTTP traffic for common application-layer attacks.

A network firewall and a WAF are not the same thing. A network firewall controls network traffic between systems or networks, while a WAF focuses specifically on protecting web applications.

How does a network firewall work?

A network firewall works by placing a security control between networks, devices, or systems and applying rules to the traffic that passes through it.

The basic process looks like this:

1. A connection is attempted.
A device tries to communicate with another device, server, website, or network resource.

2. The firewall examines the traffic.
Depending on the firewall, it may evaluate the source and destination addresses, ports, protocols, connection state, application information, or other characteristics.

3. The firewall compares the traffic with its security rules.
The firewall determines whether the connection meets the rules configured by the user or network administrator.

4. The traffic is allowed or blocked.
If the traffic meets the requirements, the firewall allows it to continue. If it violates a rule, the firewall can block or reject the connection.

5. The firewall may log the activity.
Many firewalls record allowed or blocked connections so administrators can monitor network activity and investigate potential security issues.

Simple example of how a firewall works

Imagine a company with 100 employees connected to the internet.

When an employee's computer requests a connection to an approved website, the network firewall evaluates the connection and determines whether it meets the organization's security rules.

If the connection is allowed, the firewall permits the traffic to pass.

Now imagine an outside system attempts to connect directly to a service that the company has not made available to the internet. The firewall can recognize that the connection does not meet its rules and block it.

This allows the organization to control which types of network communication are permitted rather than leaving every network service openly accessible.

What can a firewall protect against?

Firewalls can help reduce exposure to certain types of unauthorized network activity, including:

• Unauthorized connection attempts
• Access to restricted network ports
• Unwanted inbound traffic
• Certain types of malicious network traffic
• Unauthorized communication between network segments
• Attempts to access restricted network resources

However, firewalls have limitations.

A firewall may not stop a user from intentionally downloading malware, clicking a malicious link, or providing sensitive information to a scammer. It also cannot protect against every vulnerability in software or every type of attack.

For that reason, firewalls work best as part of a layered security strategy that can also include endpoint protection, secure authentication, software updates, encryption, backups, and security awareness.

Where are firewalls used?

Firewalls can be used in many environments, including:

Home networks

Many home routers include built-in firewall capabilities. These can help control traffic between the internet and devices connected to the home network.

Business networks

Organizations can use network firewalls to control traffic between internal networks, the internet, remote users, servers, and other network segments.

Individual computers

Operating systems can include host-based firewall capabilities that control network connections to and from an individual device.

Cloud environments

Cloud-based infrastructure can use firewall rules and other network security controls to restrict communication between cloud resources and external systems.

Web applications

WAFs can be placed in front of web applications to inspect web requests and help protect against common application-layer attacks.

What is the difference between a hardware and software firewall?

A hardware firewall is typically built into a network device such as a router or dedicated firewall appliance. It can protect multiple devices connected to the network.

A software firewall runs on an individual computer, server, or other device and controls network traffic to and from that device.

Some environments use both.

For example, a home network may have a firewall built into the router while individual Windows PCs use host-based firewall protection as another layer of security.

Do I need a firewall at home?

A firewall is an important part of a secure home network.

Many modern routers include firewall functionality, and operating systems such as Windows also provide built-in firewall protection. Keeping these protections enabled can help reduce unauthorized network access.

However, a firewall should not be your only security measure. You should also keep your operating system and applications updated, use strong and unique passwords, enable multifactor authentication when available, and be cautious when opening unexpected links or attachments.

HP Security Resources

Use these HP resources to learn more about protecting your devices and setting up a secure network:

HP PCs - Secure Boot

Learn how Secure Boot helps protect a Windows PC from unauthorized software during the startup process.

Learn about Secure Boot protection for your Windows PC

HP PCs - Creating a wireless home network

Learn how to set up a wireless network for your Windows PC.

Learn how to set up a secure wireless network

Connect using Wi-Fi Protected Setup (WPS)

Learn more about connecting compatible devices to a wireless network using WPS.

Learn how to use WPS for wireless connections

HP Notebook PCs - Using the HP Sure View integrated privacy screen

Learn how HP Sure View can help protect information displayed on your screen from visual snooping.

Learn about HP Sure View

Frequently asked questions about network firewalls

What is a network firewall in simple terms?

A network firewall is a security system that monitors network traffic and determines which connections should be allowed or blocked. It acts as a gatekeeper between networks or devices with different security requirements.

What is the main purpose of a firewall?

The main purpose of a firewall is to control network traffic according to security rules. Firewalls can help prevent unauthorized connections and limit access to network resources.

Is a firewall the same as antivirus software?

No. A firewall controls network traffic, while antivirus or endpoint security software focuses on detecting and responding to malicious software and other threats on a device. Both can provide important layers of security.

Can a firewall stop hackers?

A firewall can block certain unauthorized connections and network traffic, but it cannot stop every type of cyberattack. Effective security requires multiple layers of protection, including software updates, endpoint security, strong authentication, and safe online behavior.

What is the difference between a firewall and a WAF?

A network firewall controls traffic between networks or systems. A Web Application Firewall, or WAF, is specifically designed to protect web applications by inspecting HTTP or HTTPS requests and blocking certain malicious web traffic.

Should I keep my firewall turned on?

In most cases, yes. Disabling a firewall can remove an important layer of network protection. If a firewall is causing a connectivity problem, it is generally better to identify and adjust the specific rule or configuration causing the issue rather than disabling the firewall entirely.

The bottom line

A network firewall monitors and controls network traffic based on security rules, helping prevent unauthorized connections and protect network resources.

Firewalls have evolved beyond basic packet filtering. Modern solutions can track connection state, inspect applications, identify threats, and provide specialized protection for web applications.

For home users, businesses, and organizations, a firewall is an important part of a broader security strategy. Keeping your firewall enabled and properly configured can help reduce your exposure to unauthorized network traffic while other security measures protect against threats that a firewall alone cannot stop.