Skip to content
Knowledge Hub/Article
Article

What Is a Firewall? Types, NGFW and DMZ Explained

We explain how a firewall filters traffic with a ruleset, its types from packet filters to NGFWs, cloud rules, the DMZ and ruleset upkeep.

Oğuzhan Gerçek··9 min read
What Is a Firewall? Types, NGFW and DMZ Explained

Short answer: A firewall is a device or piece of software that controls traffic between networks or devices according to a ruleset: it allows traffic that matches a rule and blocks what does not. In a well-configured firewall, everything not explicitly allowed is denied. Types range from simple packet filters to stateful firewalls and next-generation firewalls (NGFWs) that recognize applications and users; on a server, a host-based firewall does the same job, and in the cloud, a security group. A DMZ is the network segment where internet-facing servers are separated from the internal network by a firewall. A firewall is only as good as the upkeep of its ruleset.

What is a firewall, and what does it do?

One of the definitions in NIST's glossary describes a firewall as a gateway that limits access between networks in accordance with local security policy. NIST's firewall guide, SP 800-41 Rev. 1 (September 2009), defines firewalls as devices or programs that control the flow of network traffic between networks or hosts with differing security postures. According to the guide, organizations should use firewalls wherever their internal networks interface with external networks and wherever security requirements vary among their internal networks. NIST also notes that a common requirement for firewalls at the network edge is to encrypt and decrypt specific traffic flows, which nearly always means a VPN (VPN article).

The firewall is a core layer of network security; there is a short definition in our glossary.

How does a firewall work? Rulesets and default deny

A firewall's behavior is set by its ruleset: each rule describes traffic by address, protocol and port, and on more advanced firewalls by application and user, and carries an action, allow or deny. According to NIST, many firewalls check traffic against the rules in sequence until a match is found; on those firewalls, the order of the rules also decides the outcome.

The core recommendation of SP 800-41 is deny by default: all inbound and outbound traffic that has not been expressly permitted is blocked (port article). The outbound direction matters too: according to Microsoft, Windows Firewall blocks unsolicited inbound traffic by default but allows all outbound traffic. Least privilege, applied to a firewall, means every open door has a reason: PCI DSS v4.0 requires all allowed services, protocols and ports to be identified, approved and backed by a defined business need (Requirement 1.2.5).

Types of firewalls: from packet filtering to the application layer

SP 800-41 distinguishes these firewall technologies:

  • Packet filtering: Looks at addresses, protocol, ports, interface and direction. It is stateless: it does not link the packets of a session together and is not concerned with their content.
  • Stateful inspection: Tracks each connection in a state table and blocks packets that do not fit an expected session.
  • Application firewalls: Decide based on how an application is running over the network, and can catch unexpected command sequences and invalid input.
  • Application-proxy gateways: Open separate connections to each side, so the two hosts never talk directly. According to NIST, some of these gateways are poorly suited to high-bandwidth or real-time applications.

Whether a firewall is hardware or software does not change its type; NIST's definition covers both devices and programs.

Next-generation firewalls (NGFW) and WAFs

In Cisco's definition, an NGFW is a network security device that combines traditional stateful firewall functions with application awareness and control, integrated intrusion prevention (IPS), advanced threat detection and user identity awareness. Where a traditional firewall looks at IP address, port and protocol, an NGFW recognizes the application and the user behind the traffic, so rules can be written around applications and users, not just ports. Cisco also lists TLS decryption, decrypting and inspecting encrypted traffic; we cover its risks in our proxy article and NIST's description of the NGFW in our network security article.

A WAF protects only web applications: according to Cloudflare, it filters and monitors the HTTP traffic between a web application and the internet and protects against attacks such as SQL injection and XSS. We go into detail in our WAF article, and we handle this layer in our application security (WAF) service.

Host-based firewalls: Windows and Linux

Traffic between two devices on the same subnet may never pass through the firewall at the network edge. According to SP 800-41, a server's host-based firewall that allows only necessary traffic protects against malicious activity from all hosts, including those on the same subnet.

  • Windows: According to Microsoft, Windows Firewall (shown as Windows Defender Firewall in the Services snap-in) is enabled by default on all Windows editions; on unidentified networks, the public profile, designed with higher security in mind, applies.
  • Linux: According to the netfilter project, nftables is the packet classification framework that replaces the iptables family; it has been in the kernel since Linux 3.13.

CIS Controls v8.1 calls for firewalls on servers (Safeguard 4.4) and on end-user devices (4.5); on end-user devices, the rule should be a default deny that drops everything not explicitly allowed. We cover the device side in our endpoint security article.

Firewalls in the cloud: security groups and NSGs

In the cloud, rules attach to a virtual server or a subnet:

  • AWS: A security group acts as a virtual firewall; it is stateful and takes allow rules only. A new group has no inbound rules, and its outbound rule allows all traffic. A network ACL, which works at the subnet level, is stateless, also takes deny rules, and evaluates rules in order until it finds a match.
  • Azure: A network security group (NSG) holds allow and deny rules, processed by priority between 100 and 4096; processing stops at the first match. Default rules, which cannot be removed, allow traffic within the virtual network and outbound traffic to the internet.

In other words, outbound traffic on AWS, and traffic within the virtual network and out to the internet on Azure, are open from the start; segmentation and egress control need explicit rules. For central control, firewall-as-a-service (FWaaS) options such as Azure Firewall are also available.

What is a DMZ?

A DMZ (demilitarized zone) is the segment where internet-facing servers are kept apart from the internal network. According to SP 800-41, no single technical definition exists for firewall DMZs. In a typical setup, the DMZ is a separate interface on the firewall: traffic from the internet is routed either to the protected network or to the DMZ, and traffic between the DMZ and the internal network also passes through the firewall. According to NIST, it is common to put public-facing servers, such as web and email servers, on the DMZ. Another definition in NIST's glossary describes a DMZ as a network created by connecting two firewalls. The goal is the same: an attacker who compromises a server in the DMZ still faces a firewall rule before reaching the internal network.

The "DMZ host" setting on small-office routers is not a DMZ in this sense. Cisco's documentation describes it as a single host, fully open to the internet, and warns that if that host is compromised, the internal LAN may be exposed to further intrusion.

Managing the ruleset, patching and monitoring

According to SP 800-41, rulesets grow more complicated with age: a new ruleset that allows only outbound user traffic and inbound email will likely contain far more rules by the end of its first year in production. The guide calls for reviewing the firewall policy often, which uncovers rules that are no longer needed as well as new requirements. Managing rule changes through a formal change management process, regular backups and patching are also among its recommendations.

According to the PCI SSC, PCI DSS v4.0 replaced the term firewall with the broader network security controls (NSCs); Requirement 1.2.7 asks for NSC configurations to be reviewed at least once every six months. CIS Controls v8.1 likewise expects a documented secure configuration process for network devices, with the documentation reviewed annually (Safeguard 4.2).

The firewall itself is a target: on September 25, 2025, CISA issued Emergency Directive 25-03 over a widespread campaign against Cisco ASA and Firepower devices. The attacker could manipulate read-only memory (ROM) to persist through reboots and system upgrades. We cover one of the exploited vulnerabilities in our VPN article and the patching process in our patch management article.

NIST also calls for continuous monitoring of logs and alerts; we cover logging in our log article and correlation in our SIEM and SOC article. We handle this layer in our network security service and its design in our network & traffic engineering service.

Frequently asked questions

What is a firewall in simple terms? A device or piece of software that checks traffic between networks or devices against rules, and allows or blocks it.

What does a firewall do? It stops unwanted connections from the internet, limits traffic between segments of the internal network and puts outbound traffic under policy.

What does DMZ mean? Demilitarized zone: the network segment where internet-facing servers are separated from the internal network by a firewall.

What is the difference between a hardware and a software firewall? A network firewall sits at the network's crossing point and protects the network behind it; a host-based (software) firewall controls the traffic of a single computer or server.

What is the difference between a firewall and a WAF? A firewall decides on connections by address, port and protocol, and an NGFW also by application and user. A WAF looks for attacks inside the HTTP requests sent to a web application.

Sources