What Is a Firewall

A firewall is a security control that decides which network traffic is allowed through based on rules. It sits between networks, inspects traffic against a rule set, and permits or blocks each connection. It is a foundational defence, but on its own it stops only what its rules anticipate.

What a firewall does

Every packet trying to cross a boundary is checked against rules: source, destination, port, protocol. Allowed traffic passes, everything else is denied by default in a well configured setup. It is the first filter between a network and the outside.

The types

How rules work

A firewall processes rules in order and acts on the first match. The safe pattern is default deny: block everything, then explicitly allow only what is needed.

allow tcp from any to web-server port 443
allow tcp from any to web-server port 80
deny all

The web application firewall

A WAF is a specialised firewall for HTTP, filtering attacks like SQL injection and XSS before they reach the app. Useful, but not a fix. If a WAF is the only thing stopping exploitation, the application is still vulnerable and the finding still stands. See the SQL injection guide.

What a firewall does not stop

• Attacks over allowed ports, like most web attacks over 443
• Phishing and social engineering, which target people
• Malicious insiders already inside
• Encrypted traffic it cannot inspect

This is why a firewall is one layer, not the whole defence. Detection and response, covered in what a SOC analyst does, handle what gets through.

Firewalls from the attacker's view

Testers do not usually beat a firewall head on. They use allowed channels: attacking the web app over the open port 443, or pivoting from an already compromised internal host. The firewall was never the target.

Learn network defence properly

Firewalls are one piece of a defensive architecture. The full picture is in the SOC analyst syllabus.