Firewall Basics: What Firewalls Do and What They Cannot Protect

In network defense architectures, the firewall represents the foundational perimeter enforcement boundary between untrusted external networks and protected internal systems [1]. From home broadband Wi-Fi routers to high-throughput enterprise gateways processing millions of concurrent connections, firewalls inspect and control packet flows based on administrative security policies [1, 2].

However, network administrators often overestimate what a firewall can accomplish. A firewall is a specialized filter, not a panacea for all cybersecurity threats [1]. In this technical analysis, we examine the evolution of firewall technologies—from stateless packet filters to stateful inspection and Next-Generation Firewalls (NGFW)—and outline the explicit security boundaries and threats that network firewalls cannot mitigate [1, 3].

1. The Architectural Evolution of Firewalls

Network firewalls operate across different layers of the Open Systems Interconnection (OSI) model [1]:

1. Stateless Packet Filtering (Layer 3 & 4)

The earliest firewall design examines individual IP packets in isolation. Filtering decisions rely strictly on static header fields:

• Source and destination IPv4/IPv6 addresses
• Transport protocol (TCP, UDP, ICMP)
• Source and destination port numbers (e.g., TCP port 80 for HTTP, port 443 for HTTPS)
• TCP flags (SYN, ACK, FIN, RST)

Because stateless filters evaluate each packet without context, they cannot determine whether a packet is part of an established legitimate session or an unauthorized external probe. Stateless access control lists (ACLs) remain valuable on core routers where line-rate performance (hundreds of gigabits per second) takes precedence over complex connection tracking [1, 2].

2. Stateful Packet Inspection (SPI)

Stateful firewalls maintain a dynamic state table (connection tracking table) in memory [1]. When an internal host initiates an outbound TCP handshake to an external web server, the firewall records the 5-tuple: $$\text{Session} = (\text{Src IP}, \text{Src Port}, \text{Dst IP}, \text{Dst Port}, \text{Protocol})$$

When the external server responds, the firewall validates the incoming packet against its active state table. If the packet matches an existing outbound session, it is forwarded immediately. If an inbound packet arrives without a corresponding outbound entry, it is dropped at the interface. Stateful inspection drastically reduces the attack surface by enforcing a default-deny posture on all unsolicited inbound traffic [1].

3. Application-Layer & Next-Generation Firewalls (Layer 7 NGFW)

Modern attacks rarely target closed ports; they exploit open, permitted ports such as TCP 443 (HTTPS) [1]. Next-Generation Firewalls (NGFW) inspect packet payloads at Layer 7:

• Application Identification (App-ID): Recognizes specific applications regardless of the port number used.
• Deep Packet Inspection (DPI) & TLS Decryption: Decrypts and inspects TLS traffic against known vulnerability signatures and intrusion prevention system (IPS) engines.
• User Identity Integration: Associates network flows with Active Directory / LDAP user credentials rather than ephemeral IP addresses [1, 3].

Technical Comparison of Firewall Inspection Modes

2. What Firewalls Protect Effectively

When properly architected and audited, network firewalls deliver essential perimeter defenses [1, 2]:

1. Service Cloaking: Dropping unsolicited probes prevents automated reconnaissance tools (such as port scanners) from mapping internal services.
2. Egress Filtering: Preventing internal compromised machines from communicating with known Command-and-Control (C2) servers over unauthorized ports [1].
3. Network Micro-Segmentation: Internal firewalls restrict lateral movement between user workstations, development servers, and production database clusters.
4. Denial of Service Mitigation: Stateful syn-proxy and connection rate-limiting mitigate volumetric SYN flood attacks [1, 2].

3. The Boundaries: What Firewalls Cannot Protect

Relying on a firewall as a standalone security measure creates a dangerous false sense of security. Firewalls cannot defend against several major attack vectors [1, 3]:

1. Phishing and Social Engineering

If an employee receives an email containing a phishing link to a legitimate cloud platform (e.g., Microsoft Forms or Google Docs) and enters their corporate credentials, the network firewall sees valid outbound HTTPS traffic on port 443. The firewall cannot prevent the credential compromise [1, 3].

2. Malicious Insiders and Authorized Access Abuse

Firewalls enforce access policies between network segments. When an authenticated employee with legitimate access to a financial database downloads confidential proprietary records to a local drive, the action complies entirely with network firewall rules [1].

3. Exploits in Allowed Web Applications

If an organization publishes an e-commerce website on port 443, the firewall must permit public inbound traffic to that port. If the web application contains a SQL injection or Remote Code Execution vulnerability, an attacker can exploit the vulnerability directly over the permitted HTTP/S connection unless protected by an application security layer [1, 3].

4. Compromised Endpoint Devices

If a contractor's laptop infected with malware connects directly to the internal corporate Wi-Fi or VPN, the malware communicates behind the perimeter firewall. Without host-based endpoint detection and response (EDR), the perimeter firewall is bypassed [3].

Practical Recommendations for Firewall Implementation

To maximize firewall efficacy within an enterprise architecture:

1. Enforce Default-Deny Policies: Explicitly block all inbound and outbound traffic, allowing only authorized protocols and destination IP ranges required for business operations [1].
2. Implement Regular Rule Auditing: Remove obsolete temporary rules, duplicate definitions, and wide-open any-to-any allowances that accumulate during routine troubleshooting [1].
3. Deploy Defense-in-Depth: Combine perimeter firewalls with host-based firewalls (such as Linux nftables or Windows Defender Firewall), strong multi-factor authentication, and centralized log telemetry [1, 3].

For specialized network defense architecture and managed perimeter implementations, explore our offerings on our Network Security Solutions page.

Key Takeaways

• Firewalls are essential perimeter gatekeepers that filter unauthorized network traffic based on configured rules.
• Stateful inspection tracks connection states, while Next-Generation Firewalls inspect application-layer payloads.
• Firewalls cannot prevent phishing, credential theft, application-level vulnerabilities on open ports, or malicious insider actions.
• Effective security requires a multi-layered defense-in-depth architecture combining firewalls, host hardening, and identity controls.

Need help with this? Contact us.

Sources

[1] National Institute of Standards and Technology (NIST), "NIST SP 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy", 2009. URL: https://csrc.nist.gov/pubs/sp/800/41/r1/final (Authoritative federal standard on firewall architectures, inspection modes, and operational policies).

[2] IETF, "RFC 2979: Behavior of and Requirements for Internet Firewalls", 2000. URL: https://www.rfc-editor.org/rfc/rfc2979.html (Technical requirements and behavioral constraints for IP firewall implementations).

[3] National Institute of Standards and Technology (NIST), "NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems", 2008. URL: https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final (Guidelines on host defense-in-depth, service isolation, and complementary network boundary controls).

Last reviewed: October 2026