firewall
termA device or function that decides which traffic may pass between networks, enforcing a policy at a boundary.
The name is borrowed from a wall built to stop fire spreading between parts of a building, and the metaphor carries the assumption that has aged worst: that there is an inside and an outside. It was true when an organisation had one gateway, and it stopped being true with cloud, remote work and machine-to-machine traffic that never touches the perimeter. The function did not become useless; it multiplied and moved, into hosts, hypervisors, service meshes and cloud policy, which is what segmentation and zero trust are actually describing. The warning from the people who wrote the first book still applies: an estate where the firewall is the only secure component is one attackers go around rather than through.
NIST's guideline defines firewalls as 'devices or programs that control the flow of network traffic between networks or hosts employing differing security postures', and its catalogue of technologies shows how far the word stretches: packet filtering, stateful inspection, application firewalls, application-proxy gateways and dedicated proxy servers, and around them virtual private networking, network access control, unified threat management and web application firewalls.
Two of those matter most in daily work. A stateful firewall 'keeps track of each connection in a state table', so a reply is admitted because its request was. A proxy splits the conversation, and in NIST's words each successful attempt 'actually results in the creation of two separate connections': one from the client to the proxy, another from the proxy to the real destination, which is why a capture on either side shows a different conversation.
When a connection never establishes and nothing logs an error, a firewall's silent drop is one of the first places to look: by design, a dropped packet answers nothing.
Also known as: ngfw