Types of Firewall in Computer: 9 Types, Functions & Examples

A firewall is a security system that monitors and controls network traffic according to defined security rules. Depending on how it inspects traffic and where it is deployed, a firewall can take several forms, including packet-filtering, stateful, proxy, circuit-level, next-generation, hardware, software, cloud, and web application firewalls.

The confusing part is that these categories do not all describe the same thing. Packet filtering and stateful inspection describe how traffic is evaluated, while hardware, software, and cloud describe where or how the firewall is deployed. Understanding that difference makes firewall types much easier to compare.

For more technology and cybersecurity resources, explore HaroBuilder’s broader technology guides.

Quick Answer: What Are the Types of Firewall?

The main types of firewall in computer networks include packet-filtering firewalls, stateful inspection firewalls, proxy firewalls, circuit-level gateways, next-generation firewalls (NGFWs), hardware firewalls, software or host-based firewalls, cloud firewalls, and web application firewalls (WAFs).

They differ in what they inspect, where they operate, and the type of protection they provide. Some focus on network packets and connections, while others can understand applications or protect specific devices and web applications.

What Is a Firewall in a Computer Network?

A firewall is a device, program, or security function that controls the flow of network traffic between networks or hosts with different security requirements.

NIST describes a firewall as a device or program that controls network traffic between networks or hosts with differing security postures. Firewalls can therefore be used at an internet boundary, between internal network segments, or directly on individual hosts.

A simple example is an office network connected to the internet:

Internet → Firewall → Company Network → Computers and Servers

The firewall evaluates traffic against its configured rules. Depending on those rules and the firewall’s capabilities, traffic may be allowed, blocked, logged, inspected, or passed to another security control.

What Does a Firewall Do?

Common firewall functions include:

• Controlling inbound network traffic
• Controlling outbound traffic
• Filtering packets
• Restricting IP addresses
• Controlling ports and protocols
• Enforcing access-control rules
• Monitoring network connections
• Logging network activity
• Supporting network segmentation
• Applying application-aware policies on advanced firewalls

A firewall is one layer of a security architecture rather than a complete security solution. NIST notes that firewalls provide an additional layer of protection but cannot recognize every type of attack, particularly when malicious activity occurs outside the traffic path controlled by a particular firewall.

How Does a Firewall Work?

At a basic level, a firewall receives network traffic and compares it against security policies.

For example, a rule might allow traffic to a particular service while blocking unsolicited connections to another port.

The exact process depends on the firewall technology.

A basic packet-filtering firewall may examine information such as:

• Source IP address
• Destination IP address
• Source port
• Destination port
• Network protocol

A stateful firewall can additionally track the state of active connections.

More advanced systems can inspect application information, user context, content, or other attributes depending on their capabilities.

The basic process looks like this:

Traffic arrives → Firewall evaluates traffic → Rules/policies are checked → Traffic is allowed, blocked, or inspected → Event may be logged

NIST guidance covers firewall technologies as well as policy development, configuration, testing, deployment, and ongoing management.

How Are Firewalls Classified?

One of the easiest ways to misunderstand firewall types is to treat every label as if it belongs to one single classification system.

In practice, firewalls can be described from several perspectives.

By Traffic Inspection Method

This classification focuses on how the firewall evaluates traffic:

• Packet-filtering firewall
• Stateful inspection firewall
• Proxy firewall
• Circuit-level gateway
• Next-generation firewall

By Deployment

This classification focuses on where the firewall operates:

• Hardware firewall
• Software or host-based firewall
• Cloud firewall
• Virtual firewall

By Protection Scope

This focuses on what the firewall is designed to protect:

• Network firewall
• Host-based firewall
• Web application firewall

That means one solution can fit into more than one description. For example, a hardware appliance can provide stateful inspection and advanced application-aware capabilities at the same time.

9 Types of Firewall in Computer Networks

1. Packet-Filtering Firewall

A packet-filtering firewall evaluates network packets against predefined rules. It can make decisions based on packet-header information such as source and destination addresses, ports, and protocols.

For example, an administrator might create a rule that permits traffic to a particular service while blocking traffic directed toward an unused port.

How packet filtering works

A simplified process is:

1. A packet reaches the firewall.
2. The firewall examines relevant packet information.
3. It compares that information with configured rules.
4. The firewall allows or blocks the packet according to the policy.

Advantages

• Simple concept
• Fast for straightforward filtering
• Useful for basic access-control policies
• Can restrict traffic by IP, port, and protocol

Limitations

Traditional packet filtering has limited awareness of the broader connection or application context. A rule that evaluates individual packets does not necessarily understand the complete state of a conversation.

Packet filtering is therefore better understood as a basic inspection method rather than a complete modern security architecture.

---

2. Stateful Inspection Firewall

A stateful firewall tracks active network connections and uses connection state when making traffic decisions.

This is an important difference from basic stateless packet filtering.

Imagine a computer inside a network starts a legitimate connection to a server. A stateful firewall can keep track of that connection and use the connection state when evaluating subsequent packets.

Stateful vs. stateless firewall

Feature	Stateless / Basic Packet Filtering	Stateful Inspection
Examines packets	Yes	Yes
Tracks connection state	No	Yes
Uses session context	Limited	Yes
Rule complexity	Usually simpler	More contextual
Resource requirements	Generally lower	Generally higher
Typical use	Basic filtering	More context-aware network control

The key idea is simple:

Stateless filtering asks, “Does this packet match the rule?”

Stateful inspection can also ask, “Does this packet belong to a connection that the firewall already knows about?”

This makes stateful inspection an important foundation for many network-firewall deployments.

---

3. Proxy Firewall / Application-Level Gateway

A proxy firewall acts as an intermediary between a client and another network service.

Instead of simply forwarding traffic directly between the client and destination, the proxy can establish connections on behalf of the client and inspect traffic at the application level.

This can provide more application-aware control than basic packet filtering.

Common characteristics

• Acts as an intermediary
• Can inspect application-level traffic
• Can enforce application-specific policies
• Can provide additional control over selected services
• May introduce additional processing overhead

Proxy firewalls are useful when an organization needs more visibility or control over particular application traffic.

The trade-off is that deeper inspection and intermediary processing can add complexity and performance overhead.

---

4. Circuit-Level Gateway

A circuit-level gateway focuses on connections or sessions rather than performing the same type of detailed application-content inspection associated with a proxy.

It can evaluate whether a connection is permitted and establish a controlled communication path.

Circuit-level gateways are therefore useful for controlling particular connection types, but they should not be confused with full application-layer inspection.

Key point

A circuit-level gateway can provide session-level control without necessarily understanding the full contents of the application data being exchanged.

That distinction matters when comparing it with a proxy firewall or a WAF.

---

5. Next-Generation Firewall (NGFW)

A Next-Generation Firewall (NGFW) extends traditional firewall capabilities with more advanced inspection and security controls.

Depending on the specific product and configuration, an NGFW may combine capabilities such as:

• Stateful traffic inspection
• Application awareness
• Deep packet inspection
• Intrusion prevention
• User or identity-aware policies
• More detailed traffic visibility
• Advanced security policy controls

Not every NGFW provides exactly the same feature set, so the capabilities should always be checked against the specific product.

Why organizations use NGFWs

Traditional port-and-protocol rules can become difficult to manage in complex environments. Modern organizations may need to distinguish between applications, users, services, network zones, and other contextual attributes.

An NGFW can provide more granular controls when those capabilities are supported and correctly configured.

Example

A traditional rule might allow traffic based largely on:

Source IP + Destination IP + Port + Protocol

An advanced firewall may be able to apply additional context around:

User + Application + Network Zone + Connection + Security Policy

That does not make an NGFW automatically appropriate for every environment. The right solution depends on network architecture, security requirements, performance, management needs, and budget.

---

6. Hardware Firewall

A hardware firewall is a physical appliance or network device that performs firewall functions for connected systems.

This is a deployment or form-factor classification, not an inspection method.

A hardware appliance could use stateful inspection, application-aware controls, or other technologies depending on the product.

Common use cases

Hardware firewalls are commonly deployed at:

• Network boundaries
• Office gateways
• Data-center boundaries
• Internal network segments
• Branch-office connections

Advantages

• Can protect multiple devices through a central network point
• Centralized policy management
• Suitable for network-level traffic control
• Can integrate with other network-security functions

Limitations

• Requires appropriate network design
• Hardware capacity can become a bottleneck
• Configuration can be complex
• Does not replace endpoint or application security

A firewall appliance can be particularly useful for organizations that need centralized network controls.

---

7. Software or Host-Based Firewall

A software firewall runs on an individual computer, server, or other host.

Instead of primarily protecting an entire network boundary, a host-based firewall can enforce traffic rules directly on the device.

For example, a server may use host-level firewall rules to restrict which systems can connect to specific services.

Benefits

• Protects individual hosts
• Can provide device-specific rules
• Useful for servers and endpoints
• Can add another security layer behind a network firewall

Limitations

• Policies may need to be managed across many devices
• A compromised host can affect local security controls
• Incorrect rules can interfere with legitimate applications
• It does not replace network-level controls

For many environments, host-based protection and network-level firewalling are complementary rather than competing approaches.

---

8. Cloud Firewall

A cloud firewall provides firewall capabilities for cloud-hosted or cloud-connected infrastructure.

Cloud environments introduce different architectural requirements because applications, workloads, users, and services may not all exist inside one physical network.

Cloud firewall implementations can therefore be used to control traffic between cloud resources, networks, workloads, or external connections depending on the architecture.

Common cloud use cases

• Cloud virtual networks
• Hybrid infrastructure
• Distributed applications
• Cloud workloads
• Remote-access environments
• Microservice environments

The exact implementation varies by cloud provider and architecture, so organizations should evaluate the firewall controls available in their specific environment.

---

9. Web Application Firewall (WAF)

A Web Application Firewall (WAF) is designed specifically to protect web applications.

This makes it different from a conventional network firewall.

A WAF focuses on web traffic, commonly HTTP and HTTPS, and can apply rules to requests sent to web applications.

OWASP describes WAF technology as a way to protect web applications and maintains an open-source WAF initiative covering projects, rules, testing, and deployment practices.

What can a WAF help protect against?

Depending on its rules and configuration, a WAF can help detect or block malicious web requests associated with application-layer attacks.

Examples include patterns associated with:

• Cross-site scripting (XSS)
• SQL injection
• Malicious HTTP requests
• Abnormal application traffic

A WAF is not a replacement for secure application development. It is an additional defensive layer.

Network firewall vs WAF

Feature	Network Firewall	WAF
Primary focus	Network traffic	Web application traffic
Typical traffic	IP/network protocols	HTTP/HTTPS
Main protection scope	Networks, hosts, segments	Web applications
Common use	Network access control	Application-layer protection
Example	Restrict network ports	Inspect web requests

This distinction is particularly important for websites, SaaS platforms, APIs, and online applications.

Firewall Types Comparison Table

Firewall Type	What It Mainly Inspects	Main Purpose	Typical Use
Packet Filtering	Packet headers	Basic traffic filtering	Simple network policies
Stateful	Packets + connection state	Context-aware traffic control	Business networks
Proxy	Application communication	Application-level control	Controlled application access
Circuit-Level	Sessions/connections	Connection control	Specific gateway scenarios
NGFW	Network + application context	Advanced security control	Enterprise environments
Hardware	Network traffic	Centralized protection	Offices/data centers
Software/Host-Based	Host traffic	Device-level protection	PCs/servers
Cloud Firewall	Cloud network/workload traffic	Cloud access control	Cloud/hybrid infrastructure
WAF	Web requests	Web application protection	Websites/SaaS/APIs

The table also shows why saying there are simply “nine completely different firewall technologies” can be misleading. Some entries describe inspection technology, while others describe deployment or protection scope.

Hardware Firewall vs. Software Firewall

Hardware and software firewalls can serve different roles.

Factor	Hardware Firewall	Software / Host-Based Firewall
Deployment	Physical/network appliance	Installed on a host
Protection	Network-level	Device-level
Management	Often centralized	Often per-device or centrally managed
Best suited to	Offices, networks, gateways	PCs, servers, individual hosts
Main strength	Centralized network control	Host-specific control
Main limitation	Requires network design and capacity	Management can become difficult at scale

A business may use both rather than choosing one exclusively.

For readers working with broader technology concepts, HaroBuilder also has a guide explaining the difference between firmware and software, which can help clarify why “software” describes a deployment form rather than a particular firewall inspection method.

Stateful vs. Stateless Firewall

The difference can be summarized in one sentence:

A stateless firewall evaluates packets largely on their individual characteristics, while a stateful firewall tracks active connections and uses that context when evaluating traffic.

Simple example

Suppose a user inside a network starts a legitimate connection to an external server.

A stateless system evaluates each packet according to its configured rules.

A stateful system can maintain information about the established connection and use that state when evaluating related packets.

Stateful inspection therefore provides more context, although it also requires more resources and more sophisticated management.

Network Firewall vs. Host-Based Firewall

A network firewall protects traffic at a network boundary or between network segments.

A host-based firewall runs directly on a device.

For example:

Internet → Network Firewall → Office Network → Host Firewall → Server

These layers can complement each other.

NIST recognizes both network firewalls and host-based firewalls as important firewall technologies, with different deployment roles and security considerations.

What Are the Main Functions of a Firewall?

A firewall can perform several security functions depending on its technology and configuration.

1. Traffic Filtering

The firewall evaluates traffic and applies rules to determine what should be allowed or blocked.

2. Access Control

Administrators can define which systems, services, addresses, ports, or applications may communicate.

3. Inbound Traffic Control

Rules can restrict unwanted connections entering a protected network or host.

4. Outbound Traffic Control

Firewalls can also control traffic leaving a network, depending on the policy.

5. Port Filtering

A firewall can restrict access to specific network ports.

6. IP Address Filtering

Rules can permit or deny communication involving particular IP addresses or ranges.

7. Connection Tracking

Stateful firewalls can track active connections and use that information when evaluating traffic.

8. Logging and Monitoring

Many firewall systems record traffic events and security-related activity, which can support monitoring and troubleshooting.

9. Network Segmentation

Firewalls can be deployed between internal network zones to restrict unnecessary communication between systems.

NIST’s firewall guidance specifically addresses policy, configuration, testing, deployment, and management, showing that effective firewall security involves more than simply installing a firewall.

Where Is a Firewall Placed in a Network?

A firewall can be positioned at different points depending on what needs to be protected.

Internet perimeter

Internet → Firewall → Internal Network

This is a common boundary-control model.

Internal segmentation

User Network → Firewall → Sensitive Server Network

This can restrict communication between internal zones.

Host level

Network → Computer → Host Firewall

The firewall operates directly on the device.

Cloud environment

Internet / Users → Cloud Security Controls → Cloud Applications

The exact architecture depends on the cloud platform and application design.

NIST guidance notes that firewalls can be used not only at network perimeters but also to restrict connectivity to internal networks containing sensitive functions.

For readers who are still learning how devices connect to networks, HaroBuilder’s guide to the difference between WiFi and the Internet provides useful background on local network connectivity and internet access.

How to Choose the Right Firewall

There is no single firewall type that is automatically right for every environment.

Instead, consider what you are protecting and what traffic you need to control.

Home Users

A home user may benefit from:

• Router-level firewall capabilities
• Host-based firewall protection
• Secure Wi-Fi configuration
• Regular operating-system updates

The exact setup depends on the devices and router being used.

Small Businesses

A small office may need:

• Centralized network protection
• Stateful firewall capabilities
• Secure remote access
• Logging and monitoring
• Host-based protection
• Segmentation where appropriate

The network architecture should determine the solution rather than the product label alone.

Enterprise Networks

Larger environments may require:

• Advanced firewall controls
• Network segmentation
• Application-aware policies
• Centralized management
• Monitoring
• Intrusion-prevention capabilities
• Cloud and hybrid-network integration

An enterprise firewall should be selected as part of a broader security architecture.

Cloud and Hybrid Environments

Cloud environments may require:

• Cloud-native firewall controls
• Network segmentation
• Workload-level policies
• Identity-aware controls where supported
• Centralized visibility
• Hybrid connectivity controls

Websites and SaaS Applications

A website or SaaS application may need a WAF in addition to network-level security.

The WAF protects the web-application layer, while other firewall controls can protect network infrastructure.

Advantages of Firewalls

A properly configured firewall can provide several benefits.

Access control

It can restrict unnecessary communication.

Reduced exposure

Unnecessary services and connections can be blocked according to policy.

Network visibility

Logging and monitoring can provide useful information about traffic.

Segmentation

Internal firewalls can restrict communication between different network zones.

Policy enforcement

Organizations can create rules for how systems are allowed to communicate.

Additional security layer

Firewalls can complement endpoint, application, identity, and monitoring controls.

NIST describes firewalls as an additional layer of protection rather than a complete security solution.

Limitations of Firewalls

A firewall cannot solve every cybersecurity problem.

1. Misconfiguration

A poorly configured rule can accidentally allow unwanted traffic or block legitimate services.

2. Insider and Internal Threats

A perimeter firewall may not see malicious activity occurring entirely inside a protected network.

3. Endpoint Compromise

A firewall does not automatically remove malware from an infected computer.

4. Application Vulnerabilities

A vulnerable application may require secure coding, patching, testing, and application-layer controls.

5. Social Engineering

A firewall cannot prevent a user from voluntarily giving an attacker a password.

6. Operational Complexity

Large rule sets can become difficult to review and maintain.

7. Performance Constraints

Deep inspection and advanced controls can require additional processing resources.

NIST specifically notes that traditional perimeter firewalls cannot recognize every attack and that some internal attacks may not pass through the network firewall at all.

Common Firewall Mistakes

Avoiding configuration mistakes is just as important as choosing a firewall type.

1. Allowing unnecessary ports

Only required services should be exposed according to the organization’s security policy.

2. Creating overly broad rules

A rule that permits too much traffic can undermine the purpose of access control.

3. Never reviewing firewall rules

Old rules can remain active even after the business requirement has disappeared.

4. Ignoring outbound traffic

Security policies may need to address traffic leaving the network as well as traffic entering it.

5. Treating a firewall as antivirus

A firewall and endpoint security software perform different roles.

6. Ignoring internal segmentation

A single perimeter firewall may not be sufficient for complex environments.

7. Failing to monitor logs

A firewall generates useful operational and security information that can be lost if nobody reviews it.

8. Using unsupported assumptions

Security policies should be based on the actual network architecture, applications, users, and risks.

Firewall vs. Antivirus vs. VPN

These technologies solve different problems.

Technology	Primary Purpose
Firewall	Controls network traffic
Antivirus / Endpoint Security	Detects and responds to malicious software and activity on devices
VPN	Creates an encrypted or otherwise protected connection between endpoints/networks, depending on implementation

They should not be treated as interchangeable.

A computer can use endpoint protection while a router or network appliance controls network traffic. A VPN can then provide protected connectivity for a particular communication path.

Are Firewalls Enough to Protect a Computer?

No.

A firewall is one security layer.

A stronger security architecture may also involve:

• Secure authentication
• Multi-factor authentication
• Endpoint protection
• Software updates
• Secure application development
• Backups
• Network segmentation
• Monitoring
• Access control
• User awareness
• Incident-response procedures

NIST’s firewall guidance emphasizes firewall policy and management as part of a wider security approach rather than treating the firewall as an isolated control.

Frequently Asked Questions

What are the different types of firewalls?

Common firewall types include packet-filtering, stateful inspection, proxy, circuit-level, next-generation, hardware, software/host-based, cloud, and web application firewalls. These categories overlap because some describe how traffic is inspected while others describe deployment or protection scope.

How many types of firewalls are there?

There is no single universal number. Different security references classify firewalls according to inspection technology, deployment model, or protection scope. A practical modern classification includes packet-filtering, stateful, proxy, circuit-level, NGFW, hardware, software/host-based, cloud, and WAF technologies.

What is the main function of a firewall?

The main function of a firewall is to control network traffic according to defined security policies. Depending on the technology, it can allow, block, inspect, monitor, and log network communications.

What is a packet-filtering firewall?

A packet-filtering firewall evaluates individual network packets using information such as source and destination addresses, ports, and protocols. It is a relatively straightforward method of controlling network traffic.

What is a stateful firewall?

A stateful firewall tracks active connections and uses connection state when making traffic decisions. This gives it more context than a basic stateless packet filter.

What is a next-generation firewall?

A next-generation firewall, or NGFW, combines traditional firewall capabilities with additional security features such as application awareness and, depending on the product, intrusion prevention, deeper traffic inspection, and other contextual controls.

What is a proxy firewall?

A proxy firewall acts as an intermediary between a client and a destination service. It can provide application-level control and inspection rather than simply forwarding packets between networks.

What is a WAF?

A Web Application Firewall protects web applications by inspecting web traffic such as HTTP and HTTPS requests. It is designed for application-layer protection and is different from a conventional network firewall. OWASP maintains resources around WAF technology and implementations.

What is the difference between hardware and software firewalls?

A hardware firewall is generally deployed as a physical network appliance and can protect traffic for multiple systems. A software or host-based firewall runs directly on an individual device and can enforce device-specific traffic policies.

Can a computer use more than one firewall?

It can have multiple layers of firewall protection, but they must be configured carefully. Running overlapping controls without understanding their rules can create connectivity problems or unnecessary complexity.

Is a firewall enough to protect a computer?

No. A firewall controls network traffic but does not replace endpoint protection, secure authentication, patching, backups, application security, monitoring, or user security practices.

Key Takeaways

• A firewall controls network traffic according to security policies.
• Firewall “types” can describe inspection method, deployment, or protection scope.
• Packet filtering evaluates packet characteristics.
• Stateful firewalls track active connections.
• Proxy firewalls operate as intermediaries.
• Circuit-level gateways focus on connection/session control.
• NGFWs provide more advanced, context-aware capabilities depending on the product.
• Hardware and software describe deployment models rather than completely separate inspection technologies.
• Cloud firewalls address cloud and hybrid environments.
• WAFs specifically protect web applications.
• Firewalls are an important security layer but are not a complete cybersecurity solution.

Conclusion

Understanding the types of firewall in computer networks becomes much easier when the classifications are separated.

Packet filtering, stateful inspection, proxy filtering, circuit-level gateways, and NGFWs describe different approaches to inspecting or controlling traffic. Hardware, software, and cloud firewalls describe deployment environments, while a WAF focuses specifically on web applications.

The right choice depends on what you need to protect, where your traffic flows, how much inspection you require, and how the firewall fits into the rest of your security architecture.

For broader cybersecurity and digital-security topics, continue exploring HaroBuilder’s technology and cybersecurity resources rather than treating a firewall as the only layer of protection.