Networking / Network Security
Firewalls and Intrusion Prevention Systems (IPS)
Learn how firewalls control network traffic, how intrusion prevention systems detect suspicious activity, and how these technologies help protect computers, servers, and business networks.
What is a firewall?
A firewall is a security control that monitors and filters network traffic according to a set of rules. It can help control communication between a trusted network and an untrusted network, such as the public internet.
Firewalls can be implemented in hardware, software, cloud infrastructure, or a combination of these. Home routers commonly include firewall functionality, while organizations may use dedicated firewalls to protect offices, data centers, and cloud environments.
A simple example
Imagine an office network with employee computers and a business server. A firewall can allow approved connections to the server while blocking unsolicited connections from the internet. The protection depends on its rules and configuration.
A firewall in a network
A simplified view of traffic entering a protected network.
Internet
Incoming and outgoing connections
Firewall
Checks traffic against security rules
Protected network
Computers, servers and business devices
Diagram: conceptual example. Actual network designs vary.
How does a firewall work?
When traffic reaches a firewall, the device evaluates it against configured policies. Depending on the firewall type, it may examine IP addresses, ports, connection state, application information, or other traffic characteristics.
- Traffic arrives: A device attempts to send or receive network traffic.
- Rules are checked: The firewall evaluates the relevant policy and connection information.
- A decision is made: Traffic may be allowed, blocked, rejected, or logged.
- Events can be recorded: Logs help administrators investigate unexpected connections and policy violations.
IP addresses, ports, and protocols
Firewall rules can use source and destination IP addresses, protocol types, and port numbers. For example, a policy may permit HTTPS traffic to a public web server while denying unsolicited access to an internal administrative service.
How a firewall evaluates traffic
Approved traffic
Matches an allow rule and is permitted by the policy.
Denied traffic
Violates a blocking rule or is not permitted by the policy.
The result depends on rule order, policy configuration, and the firewall's behavior.
To understand firewall rules more clearly, read our guides to IP addresses and subnetting.
Types of firewalls
Different firewalls inspect traffic in different ways. Modern products may combine several capabilities in one device or service.
1. Packet-filtering firewall
Evaluates information such as source and destination IP addresses, protocols, and ports. It is useful for enforcing straightforward network access policies.
2. Stateful firewall
Tracks active network connections and evaluates packets in the context of those connections, helping distinguish expected response traffic from unrelated traffic.
3. Proxy or application-layer firewall
Can act as an intermediary between clients and servers. Application-layer inspection can apply policies based on higher-level protocols and application behavior.
4. Next-generation firewall (NGFW)
Combines traditional traffic controls with additional capabilities, which may include application awareness, intrusion prevention, and advanced traffic inspection.
5. Host-based firewall
Runs on an individual computer or server and controls traffic entering or leaving that device. It provides an additional layer of protection outside the office network as well.
6. Cloud firewall
Provides traffic filtering for cloud resources, applications, or network environments using cloud-based security controls.
What is an intrusion prevention system (IPS)?
An intrusion prevention system inspects network activity for patterns associated with attacks or policy violations. When it identifies activity that matches its detection and prevention rules, it can take action, such as dropping packets or blocking a connection.
An IPS may use signatures, protocol analysis, behavioral detection, or combinations of these techniques. Its effectiveness depends on detection rules, inspection coverage, configuration, and maintenance.
How an IPS responds to suspicious traffic
Detection and prevention depend on the traffic being inspected and the active security policy.
Network traffic
Traffic visible to the IPS
IPS inspection
Checks signatures, rules and suspicious patterns
No match
Traffic continues according to policy.
Threat match
Traffic may be blocked and an alert recorded.
A detection is not proof that every attack will be identified. IPS products can miss threats or generate false positives.
How an IPS detects suspicious traffic
- It inspects traffic visible to the sensor or appliance.
- It compares activity with signatures, rules, or behavioral indicators.
- It evaluates whether the activity matches a detection rule.
- If prevention is enabled, it may block the traffic and generate an alert.
For example, an IPS may identify traffic matching a known exploit signature and block the connection. It cannot guarantee that every exploit or previously unknown attack will be detected.
Firewall vs IPS: What is the difference?
A firewall enforces traffic access policies, while an IPS focuses on identifying and preventing suspicious activity within the traffic it can inspect. Their capabilities can overlap in modern security products.
| Feature | Firewall | IPS |
|---|---|---|
| Primary role | Control permitted network traffic | Detect and prevent suspicious activity |
| Common inspection | Addresses, ports, connections and applications | Attack signatures and suspicious patterns |
| Typical action | Allow, block, reject or log | Alert, drop packets or block matching activity |
| Main limitation | Permitted traffic may still be malicious | Can miss threats or produce false positives |
| Works well with | IPS, endpoint protection and secure configuration | Firewalls, monitoring and incident response |
Many next-generation firewalls include IPS features, so organizations do not always deploy them as separate devices. Administrators should verify which features are enabled and which traffic is actually inspected.
Where are firewalls and IPS deployed?
Their placement determines which traffic they can protect and inspect. Common locations include:
- Network perimeter: Between an organization's internal network and external networks.
- Internal network segments: Between departments, servers, or groups of devices to limit unnecessary access.
- Data centers: In front of important systems and applications that require restricted access.
- Cloud environments: Around cloud networks, workloads, and services.
- Individual endpoints: On laptops, desktops, and servers.
An IPS may operate inline, where traffic passes through it and can be blocked, or in a monitoring arrangement. An IDS generally detects and alerts rather than directly blocking traffic.
What firewalls and IPS cannot guarantee
These systems are important security controls, but they are not complete security solutions. A network can remain vulnerable when policies are too permissive, software is outdated, or attackers use compromised accounts and permitted connections.
- Phishing can trick users into revealing credentials.
- Stolen credentials may allow attackers to use legitimate access paths.
- Encrypted traffic may limit inspection without suitable inspection capabilities.
- Poorly maintained rules can unintentionally expose services.
- Incorrect IPS rules can miss attacks or block legitimate business traffic.
- Threats inside allowed connections may require endpoint protection, identity controls, and additional monitoring.
Firewalls and IPS should be part of a layered defense strategy, alongside backups, patching, secure authentication, endpoint protection, and incident response.
Firewall and IPS security best practices
- Use least privilege: Allow only the traffic required for a service or business function.
- Review firewall rules: Remove obsolete or unnecessarily broad rules after validating their dependencies.
- Restrict administration: Limit management access to approved devices and trusted administrative networks.
- Keep systems updated: Install security updates for firewalls, IPS appliances, operating systems, and related software.
- Maintain detection rules: Keep IPS signatures and threat intelligence current where supported.
- Monitor logs and alerts: Investigate repeated blocks, unexpected connections, and significant policy changes.
- Test changes carefully: Validate new rules and IPS policies to reduce accidental service disruption.
- Back up configurations: Maintain protected backups and a recovery procedure.
- Segment the network: Restrict unnecessary communication between users, servers, and sensitive systems.
- Prepare for incidents: Define who investigates alerts, isolates affected systems, and documents findings.
Practical learning exercise
If you are learning network defense, start with a home lab or another network you are authorized to administer.
- Identify the firewall on your router or test environment.
- Review available inbound and outbound security settings.
- Examine logs and learn how permitted and blocked traffic is recorded.
- Study IPS detection using an isolated lab and authorized test traffic.
- Document policy changes and verify that normal connectivity still works.
Do not expose administrative interfaces to the public internet or disable protections on a production network to experiment.
Frequently asked questions
What is a firewall in networking?
A firewall monitors and controls network traffic according to configured security rules. It can allow legitimate connections and block traffic that violates those rules.
What is an intrusion prevention system (IPS)?
An IPS inspects network activity for suspicious patterns and can block traffic that matches configured prevention rules.
What is the difference between a firewall and an IPS?
A firewall primarily controls permitted network traffic. An IPS focuses on detecting and preventing suspicious activity within the traffic it can inspect.
Can a firewall stop every cyberattack?
No. A firewall cannot prevent every phishing attempt, compromised account, malicious file, or threat using permitted connections.
Is an IPS the same as an IDS?
No. An intrusion detection system (IDS) detects and alerts on suspicious activity, while an intrusion prevention system (IPS) can actively block detected traffic.
Do small businesses need firewalls?
A properly configured firewall is an important security control for small businesses. It should be combined with software updates, strong authentication, backups, and monitoring.
Continue learning network security
Explore intrusion detection, network monitoring, and wireless security to build a broader understanding of network defense.
Related networking guides
Explore related topics
Continue learning about network security and practical defense.