What is Firewall Software?
The two main ways to deploy a firewall are as firewall software running as an application on a host or as a hardware firewall running on a dedicated network device. Firewall software is widely used on personal and company laptops running Windows, macOS, and other Unix-like operating systems.
Firewall software is also available in firewall distributions that can be deployed on dedicated hardware, but for this discussion, we differentiate a software firewall from a hardware firewall in terms of how the firewall is deployed, i.e. on-host vs as a dedicated network device.
How Does Firewall Software Work?
In addition to Windows, macOS, and Linux software firewalls, firewalls can also be found embedded on IoT (Internet of Things) devices, especially those that are Linux based and use the iptables utility.
When firewall software is installed on a host, such as Windows, it can make granular network access decisions down to the application level. For instance, a web server application may be allowed to receive inbound connections on the standard TCP ports for HTTP traffic: ports 80 (HTTP) and 443 (HTTPS).
Only select services needed for normal network operations will be allowed through the firewall, and policy can be set based on profiles. For example, a domain profile may be for connections to an organization domain controller, a private profile for when connected at home, and a public profile for when connected to a public and unprotected network like Wi-Fi at the local coffee shop.
Security policy rules are typically pre-defined for each profile and can be customized if needed. By default, all outbound connections are allowed. Because of the number of devices, managing firewall software policy centrally will be difficult if this functionality isn’t included in the design of the product.
Features of Firewall Software
Software-based firewalls should have some common features, including:
- Small Footprint: Firewall software runs on a host along with other applications, so it must be able to coexist with these applications. This means sharing disk space, compute, and other system resources
- Secure: As a security product, a firewall must itself be secure and inaccessible to other applications or users. This may mean tightening user access controls on the host platform to limit local configuration changes. The same applies to permissions to uninstall, install, or stop the firewall processes.
- Cost: Typically, firewall software is included in the host product, so there isn’t a fee for the firewall software itself. However, there may be fees for central management or add-on features like advanced threat prevention.
Software vs Hardware Firewalls
Different deployment locations mean that the feature set is slightly different between software firewalls and hardware firewalls. Both have the same core firewall capabilities, but what they control differs slightly.
Network-Level
Hardware firewalls are deployed on the network, enabling them to provide network-level functionality, such as:
- Routing: Hardware firewalls sit as a border device separating one part of the network from another. This means they can be deployed in routing mode and participate in routing decisions. This allows them to take on the role of a router and decide which network path a packet takes to get to its destination.
- Network Address Translation (NAT): The hardware firewall may act as a gateway between two types of networks; for instance, from a private network to a public network. A common feature of hardware firewalls is the ability to hide private networks from the publicly routable address space. This saves IP addresses and hides internal addresses, providing cost and security benefits.
- Centralized Management: Hardware firewalls separate large groups of computers, so there is also some benefit from economies of scale in terms of deployment and management.
Host-Level Features
Software firewalls typically run on the host, providing them with certain capabilities, such as:
- Granular Application-Level Access: Hosts have more granular control of the applications allowed on the host and these applications’ network access.
- Integration with EDR: Firewall software may be part of an integrated security suite that monitors the host for ransomware threats or out-of-band attacks, like from a malicious USB device. On-device monitoring provides a rich source of data that can help respond to threats.
- Device Security: Firewall software travels with the device. When the device is a laptop that travels with the user, the firewall is not left behind on the company network and still actively enforces company policy.
Key Benefits of Firewall Software
In comparison to hardware firewalls, software firewalls provide the following key benefits:
- Granular Security: A software firewall provides direct device-level and application control of the host network access; both inbound and outbound.
- Mobile Security: Software firewalls travel with the device; both on-network and off when the user is traveling or working from home.
- Improved Device Visibility: Software firewalls have deep visibility into device network activity that can be used by an endpoint detection and response (EDR) solution.
Which Kind of Firewall Software is Right For You?
The choice between a software and hardware firewall should depend on what the firewall is intended to secure. If you have mobile or users who work from home, then firewall software is probably the right choice over a hardware firewall. On the other hand, if you have a remote site, then a hardware firewall that can be used as a perimeter gateway is a logical choice.
If you need to secure both remote users and remote sites but don’t need granular device-level access or granular site-level access control, then consider a third option: a firewall-as-a-service (FWaaS) deployed in a SASE (Secure Access Service Edge) model. If you need to secure private or public cloud infrastructure, then consider a cloud firewall.
Today’s modern Next-Generation Firewalls (NGFWs) provide you with a solution that fits any deployment choice. To learn more about how to select a firewall, check out this NGFW Buyer’s Guide. You’re also welcome to request a free demo to see the capabilities of Check Point NGFWs for yourself.
Feedback