Firewall

Added on April 5, 2026

A firewall is a device within a network responsible for determining what traffic is allowed to enter and exit. An administrator can configure a firewall to permit or deny traffic from entering or exiting a network based on numerous factors such as:

• Where the traffic is coming from? (has the firewall been told to accept/deny traffic from a specific network?)
• Where is the traffic going to? (has the firewall been told to accept/deny traffic destined for a specific network?)
• What port is the traffic for? (has the firewall been told to accept/deny traffic destined for port 80 only?)
• What protocol is the traffic using? (has the firewall been told to accept/deny traffic that is UDP, TCP or both?)
• Firewalls perform packet inspection to determine the answers to these questions.

Firewalls come in all shapes and sizes. From dedicated pieces of hardware (often found in large networks like businesses) that can handle a magnitude of data to residential routers or software such as Snort.

Stateful

This type of firewall uses the entire information from a connection; rather than inspecting an individual packet, this firewall determines the behaviour of a device based upon the entire connection.

This firewall type consumes many resources in comparison to stateless firewalls as the decision making is dynamic. For example, a firewall could allow the first parts of a TCP handshake that would later fail.

If a connection from a host is bad, it will block the entire device.

Stateless

This firewall type uses a static set of rules to determine whether or not individual packets are acceptable or not. For example, a device sending a bad packet will not necessarily mean that the entire device is then blocked.

Whilst these firewalls use much fewer resources than alternatives, they are much dumber. For example, these firewalls are only effective as the rules that are defined within them. If a rule is not exactly matched, it is effectively useless.

However, these firewalls are great when receiving large amounts of traffic from a set of hosts (such as a Distributed Denial-of-Service attack)