What Is a Firewall? Hardware vs Software, Settings and Setup

Quick Answer

A firewall controls network traffic according to security rules. It permits approved connections and blocks unwanted connections between networks or between a device and the network. A hardware firewall usually protects traffic passing through a dedicated network appliance, while a host-based software firewall protects the computer on which it runs.

These protections complement each other. A network firewall controls access between network segments, while a computer’s firewall can restrict connections reaching that computer, including from nearby devices. Configuration involves deciding which connections are necessary and allowing only the appropriate sources, destinations, applications, and services.

Hardware Firewall vs Software Firewall

The terminology is simplified: hardware appliances also run software. A software firewall can additionally run as a virtual network appliance, protecting multiple systems rather than only its own host.

Benefits and Features

The main benefit is controlled access: a service can be available to the people or devices that need it without being available to everyone.

• Connection filtering: Permit or deny traffic using addresses, protocols, ports, or applications.
• Stateful inspection: Track connections so that legitimate response traffic can be distinguished from unsolicited traffic.
• Segmentation: Restrict communication between groups such as employees, guests, and servers.
• Logging: Record connection decisions and administrative activity to support investigation.

Many next-generation firewalls (NGFWs) offer additional application controls, intrusion prevention, malware inspection, website filtering, VPN connectivity, and centralized reporting. These capabilities depend on the product, software release, configuration, and subscription. They are not automatically included or enabled on every firewall.

A firewall does not replace software updates, endpoint protection, secure authentication, or backups. Permitted traffic can still carry threats.

What Are the Default Firewall Settings?

There is no universal default configuration. Distinguish the manufacturer’s initial settings from the effective settings currently applied by an administrator, installer, or management policy.

Windows Firewall Defaults

Responses to permitted outbound connections are not equivalent to unsolicited inbound connections. Microsoft recommends keeping Windows Firewall enabled.

Hardware Firewall Defaults

Check the exact model’s setup guide for its management address, initial credentials or enrollment process, interface assignments, DHCP behavior, and starting rules. A setup wizard may create policies that differ from the untouched factory configuration.

Do not assume that internet access, threat inspection, remote management restrictions, or logging are configured correctly simply because the appliance starts successfully. Inspect the resulting configuration before deployment.

Which Settings Must Be Entered Manually?

The following is a planning checklist. Some values can be learned automatically or supplied by central management; others must come from your internet provider or network design.

For a concrete vendor example, Fortinet documents WAN interfaces and default routes in its FortiOS basic settings guide. Follow documentation matching your installed release.

How to Configure a Hardware Firewall

This is a deployment checklist, not a universal sequence of vendor menu commands.

1. Define the required connections. List which users and devices need access to which services. Identify employee, guest, server, and management networks.
2. Prepare the appliance. Follow its initial setup guide from a trusted management connection. Secure administrator access and follow the vendor’s supported firmware update procedure.
3. Configure connectivity. Apply the verified WAN, LAN, DNS, DHCP, and routing settings. Check basic connectivity before adding optional inspection features.
4. Restrict management access. Limit administration to approved management sources. Avoid exposing the administrative interface directly to the internet.
5. Create the required policies. Permit justified connections and deny unauthorized traffic. Review any broad rules created by the setup wizard. Apply controls to IPv6 as well as IPv4 where used.
6. Enable appropriate inspection and monitoring. Configure licensed security services, useful logs, accurate timestamps, and alerts. Test changes before applying them broadly.
7. Verify and save. Test required access and prohibited access, then save a protected copy of the working configuration.

A restrictive outbound policy requires planning: identify application dependencies before enforcing it across a business network. Review rules whenever services are introduced, changed, or retired.

How to Configure Windows Firewall

Check Protection First

1. Open Windows Security.
2. Select Firewall & network protection.
3. Identify the active network profile and confirm that Microsoft Defender Firewall is on.
4. For a blocked application, investigate a suitable exception instead of turning off the firewall.

Organization policies may prevent local changes. The option to block all incoming connections, including allowed applications, is stricter than normal inbound filtering and can interrupt services.

Create a Restricted Inbound Rule

Requirements: Local administrator rights, the application’s verified executable path, its required protocol and listening port, and the addresses of approved clients. Record the existing settings before making changes.

1. From Firewall & network protection, select Advanced settings.
2. Select Inbound Rules, then New Rule.
3. Select Custom so that application, protocol, port, and address restrictions are available.
4. Select the required program or service.
5. Choose the documented protocol and local listening port. Do not substitute the client’s temporary source port.
6. On Scope, restrict remote addresses to the approved clients or subnet.
7. Select Allow the connection and only the necessary network profiles.
8. Give the rule a descriptive name and record its purpose.

For an inbound service rule, the local port belongs to the receiving computer. Combining program and port restrictions prevents unrelated programs from using the same exception.

Windows Firewall does not use a manually ordered, first-match rule list. Explicit block rules generally override conflicting allow rules. Centrally managed policies can also prevent local rules from taking effect, so repeatedly adding allow rules may not resolve a conflict. 

Verification, Troubleshooting, and Rollback

• Test allowed access: Connect from an approved client using the actual application.
• Test denied access: Confirm that an unauthorized source cannot reach the protected service.
• Check the destination: Verify that the application is running and listening on the expected address and port.
• Check the path: Review routing, address translation, network firewall rules, and the destination’s host firewall.
• Inspect evidence: Compare timestamps, addresses, ports, and matched rules in available logs. A failed ping alone does not prove that an application port is blocked.
• Undo narrowly: Disable a newly added rule or restore the specific settings changed. Use the vendor’s documented recovery process if management access is lost.

Do not use a factory reset as the first troubleshooting step. It can remove the configuration required to restore connectivity. Windows Firewall’s restore-defaults option can also disrupt custom exceptions, and organizational policies may be reapplied afterward.

Firewall Hardware Companies and Example Models

The following are examples listed in official vendor documentation checked on 26 October 2026. They are not a popularity ranking or a recommendation that every model suits every network.

How to Compare Models

Compare performance with the security functions you intend to enable. Vendors publish separate measurements for basic firewall traffic, threat inspection, VPN traffic, and encrypted-traffic inspection; these figures are not interchangeable. Also check interface speeds, connection capacity, supported software, support lifecycle, management requirements, and renewal costs.

Confirm exactly what happens when a subscription expires. For example, SonicWall documents hardware-only operation for the listed Gen 8 TZ models, while its TZ80 requires an active subscription to function. Subscription behavior should never be assumed across an entire brand. 

Sources

• NIST: Guidelines on Firewalls and Firewall Policy — foundational firewall concepts.
• Microsoft: Windows Firewall overview, rule behavior, and configuration procedures.
• Microsoft Support: Firewall and network protection in Windows Security.
• CISA: Enhanced Visibility and Hardening Guidance and NSA: Network Infrastructure Security Guide.
• Fortinet: Small Business Network Firewalls.
• Sophos: XGS Series Firewall Comparison.
• Palo Alto Networks: PA-400 Series Overview.
• Cisco: Secure Firewall 1200 Series Data Sheet.
• SonicWall: TZ Series firewalls and Gen 8 TZ licensing.