What is Firewall?

Firewalls evolved from simple packet filters that examined each packet's source and destination IP, port, and protocol in isolation. Stateful packet inspection added a connection table that tracks the state of every session, so the firewall can distinguish a legitimate response to an outbound request from an unsolicited inbound packet. Rules are evaluated top-down: each rule is an allow or deny decision matched against traffic attributes, and most deployments end with an implicit deny-all that blocks anything not explicitly permitted.

Traditional firewalls make decisions on Layer 3 and Layer 4 attributes alone. Next-generation firewalls (NGFWs) add deep packet inspection, application awareness, user-identity integration, TLS decryption, and an integrated intrusion prevention engine, so policy can target the actual application rather than just a port number. Firewalls also define network zones, grouping interfaces by trust level (internet, DMZ, internal, management) and governing how traffic moves between them. A web server in the DMZ might accept inbound HTTPS from the internet zone while being denied any path back into the internal zone, containing the blast radius if it is compromised.

For a SOC, the firewall log is one of the richest network telemetry sources. Denied connection entries expose port scans, reconnaissance, and command-and-control callbacks, while allowed connections reconstruct which internal host talked to which external address and when. During incident response, analysts pivot to firewall logs to confirm whether a suspicious connection actually completed, to scope lateral movement across network zones, and to verify that a containment block took effect.