Firewall

The most basic firewall feature is the packet filter, which applies a set of rules called a ruleset and does not track the state of each traffic flow. Stateful inspection monitors the state of connections and lets through packets that belong to a known active connection. Deep packet inspection examines the payload of each packet as well as the header, which helps find threats in the data stream such as data exfiltration attempts and malware.

Most firewalls were once deployed at network perimeters, but attacks sent from one internal host to another often do not pass through a network firewall. Networks now often include firewall functionality inside the network as an additional layer of security. Host-based firewalls on servers and personal firewalls on desktops and laptops are software that runs on the host and controls that one host's incoming and outgoing traffic.

A firewall policy defines how firewalls handle inbound and outbound traffic for specific IP addresses and address ranges, protocols, applications, and content types. NIST recommends deny by default: blocking all inbound and outbound traffic that the policy has not expressly permitted.

A firewall works only on traffic it can inspect. It cannot read encrypted application data, and some firewalls cannot understand tunneled traffic. Threats have also moved from the lower layers of network traffic to the application layer, which has reduced how well firewalls stop threats carried in network communications, though firewalls are still needed against threats at the lower layers.