What Is a Firewall in Cyber Security? Types, Working and Best Practices

What Does a Firewall Do?

Think of a firewall as a security guard at the entrance of a building who checks every visitor against a list. It sits between networks of different trust levels — for example between the internet and an office network, or between a user zone and a server zone — and decides which connections may pass. Rules typically consider the source and destination address, port, protocol and direction, and more advanced firewalls also consider the application, user identity and content.

A firewall reduces the attack surface by blocking unnecessary services, limits lateral movement between zones and generates logs that analysts can investigate. It is not a complete security solution: it cannot stop a user from willingly entering a password on a phishing page or from running malware delivered through an allowed channel.

How a Firewall Works: Rules in Action

A firewall rule base is read from top to bottom, and the first matching rule is applied. A simplified example for an office:

The final “deny all” rule implements the principle of default deny: anything not explicitly permitted is blocked.

Types of Firewalls

• Packet-filtering firewall: examines each packet’s header and compares it against rules. Fast but unaware of connection state or application content.
• Stateful inspection firewall: tracks the state of connections so that return traffic for an allowed request is automatically permitted.
• Proxy or application-layer firewall: acts as an intermediary and can inspect specific protocols such as HTTP.
• Next-generation firewall (NGFW): adds application awareness, user identity, intrusion prevention, TLS inspection and threat intelligence.
• Web application firewall (WAF): protects web applications from attacks such as SQL injection and cross-site scripting.
• Host-based firewall: runs on an individual computer, like Windows Defender Firewall or iptables.
• Cloud firewall / security groups: virtual controls that protect cloud workloads.

Hardware vs Software vs Cloud Firewalls

Hardware appliances from vendors such as Fortinet, Palo Alto Networks, Cisco and Check Point are deployed at network edges and in data centres, offering high throughput. Software firewalls run on servers or endpoints and are valuable for protecting individual hosts. Cloud-native firewalls, such as AWS security groups, Azure Network Security Groups and managed WAFs, provide scalable protection without hardware. Most organisations use a combination, a design known as defence in depth.

What Firewalls Cannot Do

Understanding limits prevents false confidence. A firewall cannot stop attacks that arrive through allowed channels such as phishing emails or malicious web downloads unless it has additional inspection features. It cannot protect against insiders who already have access, weak passwords, unpatched internal systems or encrypted traffic it cannot decrypt. It must be configured, reviewed and monitored; an over-permissive rule base can be worse than none because it creates a false sense of security.

Firewall Best Practices

1. Adopt default deny and allow only what is necessary.
2. Segment the network into zones such as user, server, DMZ and management.
3. Document every rule with an owner, purpose and expiry date.
4. Review the rule base periodically to remove unused or overly broad rules.
5. Keep firmware and signatures updated.
6. Restrict management access to a dedicated network with MFA.
7. Log denied and allowed traffic and forward logs to a SIEM.
8. Test changes in a lab and have a rollback plan.
9. Combine with intrusion prevention, endpoint protection and monitoring.

Learning Firewalls Hands-On

The best way to understand firewalls is to build one. In our network security course you configure pfSense or Linux firewalls in a lab with a DMZ, test rules with Nmap, capture traffic in Wireshark and write intrusion detection rules with Suricata. Those same labs prepare you for certifications such as Security+ and vendor firewall exams. If you are new, start with the complete cyber security course, then specialise.

Common Misconceptions About Firewalls

• “A firewall makes a network secure.” It is one control among many.
• “Home users don’t need one.” Router and OS firewalls should stay on.
• “Allowing all outbound traffic is harmless.” Malware uses outbound connections to receive commands.
• “Rules never need review.” Old rules accumulate risk.
• “A WAF replaces secure code.” It adds protection but cannot fix all flaws.

Hands-On Exercise: Build a Mini Firewall Policy

In a lab with pfSense or a Linux firewall VM, create three zones: LAN, DMZ and WAN. Allow LAN users to browse the internet, allow the internet to reach a web server in the DMZ on port 443 only, block DMZ-to-LAN traffic and log all denied packets. Test with Nmap from different zones and check that the logs show blocked attempts. Document the rule table and screenshots. You will extend this in the network security course.

Self-Test

1. What does default deny mean? (Everything not explicitly allowed is blocked.)
2. Which firewall type tracks connection state? (Stateful inspection.)
3. What protects web applications specifically? (A WAF.)
4. Why log denied traffic? (For detection and troubleshooting.)
5. What is a DMZ? (A network zone for public-facing servers.)

Illustrative Scenario: The Forgotten Rule

During a quick maintenance task years ago, an engineer opened remote desktop access to a server from any address “temporarily”. The rule was never removed. One day automated scanners find the open port, brute-force a weak password and deploy ransomware. A routine rule-base review would have flagged the broad rule, and a policy requiring expiry dates on temporary rules would have prevented it. Firewalls fail less from technology than from neglected rules.

Practical Tips for Firewall Administrators

• Add a comment and ticket reference to every rule.
• Prefer named objects over raw IP addresses for clarity.
• Use staging or simulation modes when testing new policies.
• Back up configurations before changes and after approval.
• Alert on changes made outside the change window.

Where to Go Next: Practice and Resources

Foundational topics become easier once you see how they connect. Treat each article as one piece of a map: networks carry data, operating systems run services, applications process input, people make decisions and attackers look for the weakest link among them. Revisit the basics regularly, because later topics such as cloud security and incident response build directly on them.

• Official documentation and RFCs for protocols you use daily.
• OWASP and MITRE ATT&CK websites for structured knowledge.
• Beginner labs on guided learning platforms.
• Government awareness portals for scams and safe practices.
• A study partner with whom you can explain concepts to each other.

More Questions Learners Ask

Do I need to memorise all these terms?

No. Understand the idea behind each term and how it appears in a real incident; vocabulary becomes natural through labs and repetition.

What is the best order to learn security topics?

Start with networking and operating systems, then threats and controls, then hands-on labs, and finally a specialisation.

How can I test whether I really understand a concept?

Try to explain it in two minutes to a non-technical friend and then demonstrate it in a lab.

Are free resources enough for fundamentals?

They are a good start, but structured feedback from a live course helps you avoid gaps.

How often do fundamentals change?

Core principles change slowly, while tools and threats change quickly, so invest more in principles.

Which fundamentals matter most for employers?

Networking, Linux and Windows basics, common attack types and clear communication.

Interview Questions Related to This Topic

Employers often use fundamentals like these to check whether a candidate really understands a topic. Try answering in your own words before reading the model answer.

What is SQL injection and how do you prevent it?

It is an attack where user input alters a database query. Prevention uses parameterised queries, input validation, least-privilege database accounts and a WAF as an extra layer.

What is a SIEM and what does it do?

A SIEM collects and correlates logs from many sources, raises alerts on suspicious patterns and supports investigations and reporting.

What is the difference between a threat, a vulnerability and a risk?

A threat is something that can cause harm (for example a phishing campaign), a vulnerability is a weakness that the threat can exploit (an untrained user or unpatched server) and risk is the likelihood and impact of that combination. Interviewers like answers that use a concrete example.

Terms to Remember

A shared vocabulary makes learning faster. These terms appear repeatedly in classes, labs and interviews:

• Botnet: A network of infected devices controlled remotely by an attacker, often used for DDoS or spam.
• DPDP Act: India’s Digital Personal Data Protection Act 2023, which sets duties for organisations that process personal data and rights for individuals.
• Credential stuffing: Using username and password pairs leaked from one site to try to log in to others, relying on password reuse.
• SIEM: A platform that collects logs from many systems, correlates events and raises alerts for analysts to investigate.
• Zero-day: A vulnerability that the vendor does not yet know about or has not yet patched, making it especially dangerous.
• 3-2-1 backup: Keep three copies of data on two different media with one copy offline or off-site, so that ransomware cannot destroy every copy.

Learn This Hands-On: Recommended Courses

Reading builds understanding, but practice builds skill. If this topic interests you, the best next steps are Network Security Course, Cyber Security Course and CompTIA Security+ Training. Every course includes live labs, and a new batch starts every week. You can try a free demo class first, compare fees or read about the cyber security course in your city.

Related reading: Types of Cyber Attacks: 15 Common Attacks Explained With Examples • What Is SIEM in Cyber Security? How It Works, Tools and Use Cases • What Is a Vulnerability in Cyber Security? Types, CVE, CVSS and Management.