Every business is told it needs a firewall. Most businesses have something called a firewall. Very few people in those businesses could accurately explain what it does, whether it's configured correctly, or whether the device they have is actually appropriate for their size and risk level. That gap — between having something and understanding whether it's working — is where most security problems hide.
This guide explains what a firewall actually does, the different types and what distinguishes them, and how to know whether your business has adequate protection.
The Basic Concept
A firewall is a security control that sits between your network and the outside world — or between different parts of your network — and decides what traffic is allowed through and what gets blocked. Think of it as a border checkpoint. Every piece of data trying to enter or leave your network passes through the firewall, which applies a set of rules to determine whether that traffic is permitted.
In the early days of networking, firewalls were relatively simple. They looked at the source and destination of a data packet — the IP address and port — and checked it against a list of allowed or blocked combinations. If your rule said "allow traffic from the internet to port 80" (the standard web port), web traffic got through. If it said "block everything else," everything else was blocked. Straightforward, but limited.
Types of Firewall: What the Labels Actually Mean
Packet Filtering Firewalls
The most basic type, operating at the network layer. They check the headers of network packets — source IP, destination IP, source port, destination port, and protocol — and apply rules accordingly. They don't look at the content of the traffic or track the state of connections. Fast and lightweight, but easily circumvented by modern attack techniques. You're unlikely to encounter a pure packet filter in a business context today; the term is mainly relevant as a historical baseline.
Stateful Firewalls
An improvement over packet filtering, stateful firewalls track the state of active connections. Rather than examining each packet in isolation, they understand whether a packet is part of an established, legitimate connection or an unsolicited incoming attempt. This closes off a class of attacks that packet filters are vulnerable to. Most basic business-grade routers include stateful firewall capability, which is why the router your ISP provided probably describes itself as having a built-in firewall — technically true, but not the whole picture.
Next-Generation Firewalls (NGFW)
This is the category most IT providers mean when they recommend a business firewall in 2026. A next-generation firewall does everything a stateful firewall does and adds several important capabilities:
- Deep packet inspection (DPI): Instead of only checking packet headers, a NGFW examines the actual content of the traffic. It can identify what application generated the traffic, regardless of what port it uses.
- Application awareness: A NGFW can distinguish between different applications using the same port — blocking Facebook while allowing Microsoft Teams, for example, or restricting certain features of an application without blocking it entirely.
- Intrusion prevention: Built-in IPS functionality identifies and blocks known attack patterns within traffic, including exploits targeting specific software vulnerabilities.
- SSL/TLS inspection: Modern attacks increasingly hide inside encrypted traffic. A NGFW can decrypt, inspect, and re-encrypt HTTPS traffic to check it for threats — a capability basic firewalls entirely lack.
- Threat intelligence integration: NGFWs receive continuous updates about known malicious IP addresses, domains, and traffic signatures, allowing them to block newly identified threats automatically.
The NGFW caveat: A next-generation firewall is only as good as its configuration and its active subscriptions. Many businesses have NGFW hardware in place but are running it without active threat intelligence subscriptions, or with a default configuration that hasn't been reviewed since installation. The box ticked on procurement doesn't mean the protection is working.
Unified Threat Management (UTM)
A UTM appliance combines a next-generation firewall with additional security functions — typically web content filtering, email filtering, antivirus at the gateway level, and sometimes VPN functionality — into a single managed device. UTMs are popular with SMEs because they consolidate multiple security functions under one management interface and one support contract. Whether a UTM or a dedicated NGFW is the right choice depends on your existing security stack and the complexity of your environment.
Software Firewalls vs Hardware Firewalls
When people talk about business firewalls, they're usually referring to a hardware appliance — a physical device installed between your internet connection and your internal network. But there's also a second layer that often gets overlooked: the software firewall running on each individual device.
Windows includes a built-in software firewall, and macOS has one too. These operate at the device level, controlling what traffic individual applications can send and receive. They're a useful secondary layer — if an attacker gets past your network firewall, the device firewall provides an additional barrier. In a well-configured environment, both layers are active and correctly configured.
The software firewall is also more relevant if your staff work remotely. When someone connects from a home network or a coffee shop, the business hardware firewall isn't protecting them. Their device's software firewall, combined with a VPN back to your business network, is what maintains protection outside the office.
What Does a Correctly Deployed Firewall Actually Do for You?
A properly configured next-generation firewall, kept current with active subscriptions, provides protection across several dimensions:
- It blocks inbound connection attempts from known malicious sources before they reach your systems
- It prevents malware on an internal device from communicating with external command-and-control servers — disrupting ransomware and data exfiltration attacks even after initial infection
- It can enforce web filtering policies, blocking access to categories of known malicious or inappropriate sites
- It provides visibility into your network traffic that makes incident investigation possible when something does go wrong
- It can enforce segmentation between different parts of your network — keeping, for example, a compromised device on the guest Wi-Fi from reaching your file servers
Do You Actually Need One?
Yes — if your business has more than one or two people and handles any data that matters. The ISP-provided router that most small offices use has a basic stateful firewall, but it lacks the application awareness, intrusion prevention, and threat intelligence that modern attacks require to detect and block. It won't inspect encrypted traffic. It won't identify malware trying to phone home. It won't alert you when something unusual happens on your network.
The threshold question isn't whether you need a firewall — it's whether the firewall you have is appropriate for your risk level and properly maintained. That's a question worth asking your IT provider directly, with a request for specifics rather than reassurances.
Questions worth asking your IT provider: What firewall appliance do we have? Is the threat intelligence subscription active and current? When was the configuration last reviewed? Are we running SSL inspection on outbound traffic? Is the firewall logging, and is anyone reviewing those logs?
What to Do If You're Not Sure
If you don't know what firewall protection your business has, that's the starting point. A basic security review should be able to tell you what's in place, whether it's appropriately licensed, and whether the configuration is sensible for your environment.
For businesses in the East Midlands we work with, the most common finding is a legitimate NGFW appliance that's running on expired subscriptions — meaning the hardware is present but the threat intelligence and intrusion prevention aren't updating. It's a surprisingly common gap, and it leaves businesses thinking they're protected when the protection is significantly degraded.
Security is only as strong as the weakest maintained layer. A firewall that isn't kept current is one of the easier gaps for an attacker to exploit.