How Does a Firewall Work? | Fortinet

What is a Firewall?

The answer to what is a firewall is a firewall helps protect your network from attackers. A firewall shields your network because it acts as a 24/7 filter, scanning the data that attempts to enter your network and preventing anything that looks suspicious from getting through.

A simple way to explain how a firewall works is to think of it as a security guard with intimate knowledge of millions of potential criminals. If the guard sees one, he or she keeps the criminal out of the building. Similarly, a firewall’s protection comes from monitoring and regulating traffic that goes in and out of your network. This is accomplished using a few different methods, including packet filtering, a proxy service, and stateful inspection. 

Firewalls can be either hardware or software, and they form a wall between your network and the internet or between segments of your network and the rest of your system. Not only do firewalls keep malicious code out of your network, but some, because they can examine data both as it comes in and goes out, can also prevent an attacker from using your system to spread harmful code.

Hardware Firewalls

A hardware firewall is a system that works independently from the computer it is protecting as it filters information coming from the internet into the system. If you have a broadband internet router, it likely has its own firewall.

To protect your system, a hardware firewall checks the data coming in from the various parts of the internet and verifies that it is safe. Hardware firewalls that use packet filtering examine each data packet and check to see where it is coming from and its location. The data the firewall collects about each packet is then compared to a permissions list to see if it fits the profile of data that should be discarded. A hardware firewall can protect all the computers attached to it, making it an easily scalable solution.

“How does a firewall work? Firewalls like the Fortigate 3500F and software programs filter inbound and outbound computer network traffic (data packets) based on security rules. Firewalls defend against unauthorized access.”

Software Firewalls

A software firewall is a program used by a computer to inspect data that goes in and out of the device. It can be customized by the user to meet their needs. Like hardware firewalls, software firewalls filter data by checking to see if it—or its behavior—fits the profile of malicious code.

Software firewalls can monitor traffic trying to leave your computer as well, preventing it from being used to attack other networks or devices. A software firewall has to be installed on each computer in the network. Therefore, a software firewall can only protect one computer at a time.

Firewalls use different methods to protect your network or computer. They include the following:

Packet Filtering

Data is organized in packets. When a firewall executes packet filtering, it examines the packets of data, comparing it against filters, which consist of information used to identify malicious data. If a data packet meets the parameters of a threat as defined by a filter, then it is discarded and your network is protected. Data packets that are deemed safe are allowed to pass through.

Proxy Service

With a proxy service, the firewall acts as a go-between positioned between your computer and anything that tries to connect to it. A proxy firewall is like a mirror of your computer and detects malicious actors attempting to get through to your device. 

Proxy firewalls are a secure solution because of the separation they provide between your computer and the internet. Attackers often need to connect directly to your computer to attack it. Because a proxy is between your computer and the internet, hackers cannot form a direct connection to it, rendering their attack useless. 

However, there are applications that proxies are not capable of supporting, and if one of these is important to your business, this could pose an issue. For example, Spotify, Google Play, and QWebView have all been known to have issues when interfacing with a proxy. Proxies also tend to work slower than other types of firewalls, which could reduce throughput and impact important business processes.

Stateful Inspection

A stateful inspection firewall inspects every data packet and compares it against a threat database. During the inspection process, the firewall checks where the data is coming from, the ports it uses, and the applications it is associated with. If the data packet checks out, it is allowed to pass. Otherwise, it is discarded. 

Stateful inspection can also collect information about the data packets that go through it and use that to gain more insights into data that may pose potential threats in the future.

Fortinet Named a Leader in The Forrester Wave™: Enterprise Firewalls, Q4 2022

According to the Forrester report, “Fortinet excels at performance for value and offers a wide array of adjacent services. Long known for its bang-for-the-buck approach to network security, Fortinet has built a flexible and capable platform with its flagship product, the FortiGate Firewall.

Get the Report