“Firewall” is a term that is coined so often and is comprehended in numerous ways as few other expressions in network security. Every practitioner uses it. However, most vendors will apply it to their products. We see it in compliance frameworks, security rules, and discussions of risk from the board level up. Of course, the meaning of the term varies by context. A simple packet filter and a high-end next-gen firewall with application inspection + threat intelligence integration are both firewalls, yet they work at very different levels of sophistication.
Deep knowledge of the term – what it originally described, how its meaning has evolved, and what it covers in terms of various implementation types, is foundational to anyone tasked with making decisions around network security architecture, writing a security policy or generating technology assessments. In this article, you will learn what the firewall in network security is, how it has evolved over time and the differences between implementations that share a name.
Security teams looking for a comprehensive reference on how the term applies to modern network security controls and what current platform capabilities are associated with it can explore firewall definition in network security as a starting point for understanding both the conceptual and technical dimensions of the technology.
The Core Definition
The simplest definition of a firewall is a system that allows network traffic only between two or more networks according to an established security policy. It represents the demarcation point between the type of network environments that can vary Most commonly this will be between a private internal network and that of a public external network such as the internet and its role is to make decisions on what traffic is allowed through or not.
Decades of technology evolution haven’t changed this definition. What has changed is the depth and sophistication of mechanisms used to exert that control, the network layers at which evaluation occurs, and the criteria available for the firewall in making allow-or-deny decisions.
The National Institute of Standards and Technology consolidates multiple authoritative definitions of the term across its published guidance. The formal definitions collected in the network security term definitions resource maintained by the NIST Computer Security Resource Center reflect how the term is applied across federal cybersecurity standards, from basic access control descriptions to inter-network gateway characterizations rooted in the original RFC 4949 definition.
The Origin of the Term
In network security, the term firewall is borrowed from structural and automotive engineering where it refers to a barrier that stops fire from one section spreading to another. In automotive design, the firewall separates the engine compartment (or another component) from the passenger cabin. In architectural designs, it segregates fire zones to prevent damage from traveling through the structure.
Applied to network security, the metaphor gets at the heart of the function: a firewall constructs a barrier between network segments and restricts traffic crossing that boundary. While a physical firewall does not put out fire, but stops its spread; so too it is the case with the network firewall, which also does not remove threats, but contains their spread between different security segments.
The word was first coined for network security in the late 1980s and early 1990s when organizations were connecting their internal networks, hence requiring a controlled perimeter with the more expansive internet surface. The first implementations were simple packet filters that looked at IP addresses and ports, but the definition of a boundary control point has never left the heart of the meaning of this term as it evolved.
What Differentiates Firewall Types
There are multiple implementations of firewalls that can be considered as various levels of inspection capabilities. It is important to recognize these differences in order that one can make sense of what any particular use of the term actually refers to in practice.
Packet Filtering
The oldest and most rudimentary implementation of a firewall merely inspects packets separately against a static rule set based on fields in the header of the packet: source IP address, destination IP address, source port; destination port; and protocol. Rules define combinations of these values which may be permitted or denied and since each Packet is inspected in isolation, it does not refer back to the connection it belongs to.
Packet filtering is suitable where only end-to-end coarse-grained access control is required and performance or resource conservation is paramount. The only downside to this is that it looks at each packet in a vacuum; it has no knowledge of connection state, no visibility as to whether one packet belongs to the session that has a legitimately established other packet and cannot inspect the data within the traffic it is actually filtering.
Stateful Inspection
Stateful inspection provided insight into connections within the packet filtering model. Instead of evaluating packets in isolation from one another, a stateful firewall keeps a table of current network connections and evaluates each packet within the context of the connection to which it belongs. This enables the firewall to differentiate between traffic that is an actual response for a session initiated from inside and unsolicited external traffic which does not have any formal establishment of the initiator from inside the hosted network.
In the 1990s and early 2000s, stateful inspection was dangled as the bare minimum baseline for the deployment of enterprise firewalls. This is what the majority of network administrators think when they say “traditional firewall” without in-depth elaboration.
Application-Layer Inspection
Application-layer inspection (also known as deep packet inspection) goes a step further by extending the scrutiny into the content of traffic, not just the header. Instead of inspecting only the source and destination address of a packet, the firewall inspects its contents which allows it to identify application protocols in use, find malicious patterns in allowed traffic, enforce content policies and recognize protocol misuse (e.g. legitimate protocol used as a covert channel).
These capabilities are the difference between modern and traditional stateful firewalls in terms of what can be considered a firewall. A platform with application-layer inspection can detect attack techniques that travel along permitted connections, enforce policy by application rather than only port, and incorporate threat intelligence, enriching content decisions.
Next-Generation Firewalls
Next-generation firewall refers to platforms that do stateful inspection and also incorporate application-layer visibility, awareness of user identity, integrated intrusion prevention, and often threat intelligence feeds and SSL/TLS inspection in a single processing architecture. Analyst coverage in the late 2000s formalized the term to separate these types of integrated platforms from the traditional stateful firewalls, which have long been without any application-layer capability.
Next-generation firewall is, in practice, now the de facto enterprise platform category and many organizations use firewall as shorthand that implicitly refers to this ability level rather than experience with older implementations that were less capable.
How the Definition Applies in Security Policy
The term “firewall” is used with less precision in security policy, compliance framework requirements, and vendor documentation. For example, if a compliance framework requires that an organization deploy firewalls at specific network boundaries, this generally means that any traffic crossing those boundaries must be controlled by policy-based access control and the required inspection depth may be explicit but is often implied by the surrounding context.
If a control references “firewalls” near the language of some policy or written compliance requirement, then it should be checked against whatever inspection level is referenced in the technical definition part of the framework instead of assuming that this distinction comes from just that word. Some requirements can be met with a packet filter, while others may require stateful inspection or application-layer controls done implicitly or explicitly.
The practical boundaries of what any given firewall implementation can and cannot accomplish and the security gaps that remain regardless of how capable the platform is are examined in practitioner analysis of firewall capabilities limitations in the context of evolving network security requirements and the complementary controls that address what firewalls do not cover.
The Role of the Firewall within Modern Security Architecture
Though the technology and definition of firewall have evolved, the foundation remains a controlled border between two network environments where some traffic is permitted and others are denied. What has changed is where that operating boundary is applied, which layers of the network stack are looked at and how its decision logic is informed.
Firewall controls exist along many points in the modern enterprise environment, including between internal networks and the internet; between segments of internal networks; between cloud environments and on-premises infrastructure; and at the host level on basic individual endpoints and servers. Since the same word describes controls in all of these contexts, precision about what type of firewall we are referring to, and what capabilities it includes becomes important when you see this term used in architecture documents, policy requirements or technology evaluations.
Frequently Asked Questions
What do you mean by firewall in terms of network security?
A firewall is the preferred term for a system that controls network traffic between one or more networks based on a defined security policy. Formal definitions from bodies such as the Internet Engineering Task Force characterize it as a barrier restricting access between networks or as appliances controlling traffic flows in environments at different security levels. It describes implementations from simple packet filters to next-gen platforms with application-layer inspection, which all share this fundamental access control function.
Why Is It Called A Firewall? Context Is Everything
This term has taken on a range of meanings over time as underlying technology matured considerably since its introduction for network security in the late 1980s. The earliest incarnation wrote about basic packet-filtering devices; over the decades, generations added stateful inspection (first) then visibility into the application layer, then integrated threat intelligence and user identity awareness. All these implementations are referred to as firewalls, but they work at various depths of inspection and can provide a vastly different level of protection. Without context and capability type specification, it is impossible to know exactly what capability is being described.
How is a next-generation firewall different from a traditional firewall?
A standard firewall focuses on stateful inspection where the state of connections is tracked and rules are enforced based on source and destination IP address and port. The next-generation firewall further augments this capability with application identification that identifies specific applications regardless of port, user identity awareness that allows for policies to be applied based on who is initiating a connection, integrated intrusion prevention that checks the payload of traffic and looks for attack patterns (in many implementations also adds SSL/TLS inspection capability so as to bring visibility into encrypted connections). They can address threat categories that stateful inspection does not detect. See more