What is a firewall?
A firewall permits or blocks network traffic according to rules. It can run as device software, a network gateway appliance or a cloud service. It does not prevent every attack independently.
Rules and inspection layers
Basic rules evaluate source, destination, port and protocol information. Stateful inspection examines packets in the context of an existing connection, while application-layer inspection considers higher-level communication properties. A web application firewall focuses on HTTP requests and has a different scope from a network firewall. Configuration aims to preserve necessary access and restrict unnecessary access. Incorrect rules can block legitimate users. Each rule should therefore have an owner, purpose and validity period, and changes should be controlled. Outgoing connections, as well as incoming traffic, need consideration according to requirements.
Implementation and limitations
Instead of exposing a web server's management port to the entire internet, suitable authentication and network restrictions can be used. Nevertheless, an allowed request may exploit an application authorization error; updates and secure development remain important. Not every firewall can inspect encrypted content. Logs should be checked for false positives and unusual behavior, not simply blocked-request counts. If a high-volume attack saturates a network connection, a firewall on the server may be insufficient; upstream protection is needed. Success means maintaining necessary services securely rather than blocking the largest possible number of requests. Access and application behavior should both be verified after rule changes.