Firewall
In network security, a firewall is a control point that allows or denies traffic according to policy. The single word now covers several distinct things: a stateful filter at the network layer, an application-aware next-generation firewall, a host firewall on the endpoint, and the cloud security group where much of the decision is actually made today.
How it works
A firewall enforces a rule about which traffic may pass. A stateful firewall works at the network and transport layers (roughly, IP addresses, ports and protocols) and tracks connection state so it can permit the return traffic of a flow it allowed. That packet by packet examination is packet filtering, and it can be done with or without tracking connection state. That packet by packet examination is packet filtering, and it can be done with or without tracking connection state. A next-generation firewall (NGFW) adds awareness of the application and, increasingly, the identity behind a flow, so a rule can say “this user may reach this application” rather than “this address may reach this port”. A host firewall runs on the endpoint itself, filtering per machine. In cloud environments the same job is done by security groups and network policies attached to workloads, which is where a great deal of real-world filtering now lives. A firewall is not a web application firewall, which inspects the content of HTTP requests.
What goes wrong
The failure we see is a firewall estate that controls the front door and nothing else. Perimeter rules are tight, but once inside, an attacker finds a flat network where any host can reach any other, because internal filtering and network segmentation were never enforced. Outbound is the other blind spot: without egress filtering, a compromised host can reach the attacker’s command and control freely. From the offensive seat, the interesting question is never whether the perimeter blocks inbound scans (it usually does) but whether internal and outbound movement is constrained at all.
Where this shows up in an audit
We test firewalls by what they enforce, not what the ruleset claims. From an internal position we map which segments can actually reach which, whether host firewalls are on and consistent, and whether outbound is filtered. In cloud we review security groups and network policies as the real enforcement layer, flagging over-broad rules and any-to-any allowances. Findings are written against the reachable path, with the traffic demonstrated. This is part of how we test what your firewalls actually enforce.