firewall

A firewall is a network security device or software that enforces an access-control policy between networks by inspecting and filtering traffic according to preconfigured rules. It is designed to prevent unauthorized access while allowing legitimate communication, typically deployed at a boundary between a trusted network and an untrusted network, such as the Internet, or on individual hosts as host-based firewalls.

Firewalls operate using techniques such as packet filtering, stateful inspection, and application-layer gateway proxies. Packet filtering checks header fields to allow or deny traffic; stateful inspection tracks active connections to make decisions based on the context of traffic; proxies can terminate and inspect application data. Modern firewalls, often called next-generation firewalls, integrate features like deep packet inspection, intrusion prevention, user identity awareness, TLS interception, and application-level control.

Types and deployment vary. Network firewalls are hardware or virtual appliances placed at network borders; host-based firewalls run on endpoints to protect individual devices; cloud-based or virtual firewalls secure cloud environments; and unified threat management devices combine firewalling with other security features. Firewalls can be stateless or stateful, depending on whether they track connection state, and they can be rule-based or policy-based to enforce organizational security requirements.

History and context: the concept emerged in the 1980s with the development of packet-filtering approaches and screening routers, leading to the term firewall as a protective barrier. Limitations include the potential for misconfiguration, the ineffectiveness against encrypted traffic without additional measures, and the need for ongoing updates and monitoring. Best practices emphasize defense in depth, least-privilege rules, regular audits, and proper maintenance of firewall policies.