What is a firewall?

Firewall: definition and purpose

A firewall checks every connection entering or leaving a network and decides, based on rules, whether it is allowed or dropped. It usually sits between the company network and the internet, but it can also separate internal areas from one another, such as office, production and guest Wi-Fi.

A distinction is made between network firewalls, which control the traffic of an entire site as a dedicated device or virtual appliance, and host firewalls, which run directly on a computer or server, such as the firewall built into Windows. The two complement each other: one protects the edge of the network, the other the individual device.

How a firewall works

The simplest form, the packet filter, compares the sender, destination, port and protocol of each data packet against a rule list. Stateful firewalls also remember which connections were initiated from the inside and only let the matching replies back in. The basic principle is: anything not explicitly allowed is blocked.

Next-generation firewalls (NGFWs) look deeper into the data stream. They identify applications regardless of port, inspect encrypted traffic via TLS inspection if desired, and often include an intrusion prevention system (IPS), web filtering and malware protection. For websites, specialized web application firewalls are available in addition.

Real-world example: a metalworking shop with guest Wi-Fi

A metalworking company with 25 employees runs office PCs, a CNC machine with a network connection, network printers and a Wi-Fi for customers and suppliers—all on the same network behind the provider’s router. Anyone connecting to the guest Wi-Fi could in theory also reach the file server and the machine control.

A firewall with separate network segments solves this: guests may only go to the internet, the machine talks only to the programming computer, and the office PCs reach the file server but not the machine controller. Remote access runs exclusively through a VPN. The rules are documented so that a substitute can understand them as well.

Limits, common mistakes and imple­menta­tion

A firewall is the foundation, but not all-round protection: phishing emails, stolen passwords or infected USB sticks bypass it, and encrypted traffic can only be inspected with additional effort. What matters are clean rules, current firmware and the interplay with endpoint protection, updates and backups.

Nano Concepts sets up firewalls as part of IT rollouts and ongoing support, documents rule sets, segments networks, installs firmware updates and monitors the systems via remote maintenance. If you wish, we also review existing configurations for legacy rules and unnecessary exceptions before they turn into a security risk.

• Overly generous rules such as “everything from everywhere allowed” that are never cleaned up
• Management interface reachable from the internet or protected by a default password
• Firmware not updated for years
• No logging, or nobody who reviews the logs
• Flat network with no separation of guests, office and machines