To better decide, it is beneficial to talk about what a firewall does. The firewall is a computing device whose sole purpose is to monitor and filter traffic. Internet communication is a process not unlike a major highway system. When you enter a address into your browser, your computer sends a signal along a network route (numbered by a port number) to another computer (described by an IP address). The port number can be between 1 and 65535, while the IP address is four numbers each between 0 and 255. The firewall will note the port and IP of each request, and based upon a set of rules the firewall will either allow or block the request. At the minimum, it will record the numbers of traffic going either way, giving a log of traffic for later review.

The difference between a hardware and software firewall arises from where the firewall sits and the mechanism it works with. A hardware firewall is a separate computing device which sits between the computer and the outside world. When the computer sends a request and the outside world replies, the firewall will review and log the request before it passes the firewall. A software firewall sits on the computer being protected reviewing all requests on the software level. Both work to protect the computer from threats entering the computer, and an infection sending data into the outside world.

The hardware firewall has the benefit of separating your computer from the process. It will review the traffic before it reaches the computer. This extends a protection that the software does not possess. The hardware firewall also has the benefit of its own resources. The firewall can also hold intelligence, filtering packets by not only where it said they came from, but where they actually came from, and their contents to an extent. The hardware firewall can also protect a number of computers on the network, as multiple computers can be on the computer side.

The shortcoming of the hardware firewall is that it does not look as hard at outgoing traffic. This can be a big problem, as some malicious programs could transmit data or launch attacks from your computer. Also, if too many computers are on the network, then the firewall will get bogged down with traffic requests, slowing the entire network down.

Software firewalls work on the individual computer. The user can choose specific programs to allow sending traffic to the outside world, and the protocol for other programs. It can be configured to deny everything but what is listed on a safe list, or it can prompt you to decide of you want to keep the site on the safe list. The big problem with the software filter is that it will only protect the computer it is on. As a result, if there are a number of computers on the network, each will need its own firewall, making it more complex to setup the network.

The question of which is better is a challenging one. Each has its own strengths. The hardware firewall is good at blocking direct intrusions and any incoming malicious code. The software firewall is better at identifying Trojans and email viruses trying to turn your computer into a zombie terminal (one that launches denial of service attacks or spam messages).

The minimum amount of protection that should be had is a hardware firewall. Upgrades and additions to your computer and its network will not affect your network security and firewall. To boost the protection, supplanting the hardware firewall with the addition of a software firewall will give a near complete protection passage. No protection is perfect; so long as there is an internet connection, then there is a possibility for someone who is highly skilled getting into your computer. The addition of firewalls will deter most attackers and block automatic, malicious scripts.

Firewalls are available both in software and hardware form:

Software Firewalls
Many Software Firewalls to be consumer packages for the home user such as Internet Security Suites with a software firewall included, these products are offered by companies such as Symantec, MacAfee.  There are Enterprise Software Firewalls on the market such as Microsoft ISA Server (Internet Security & Acceleration Server) which many argue to be one of the most customisable firewalls providing user level access both from the internet to the network and vice versa.

Hardware Firewalls
Hardware Firewalls are the norm for many organisations, unlike Software Firewalls that require a computer or server to be installed on Hardware Firewalls are an independent device that plugs in either between your internet connection and your network or provides the internet connection itself.  Depending on model can provide a range of protection to basic blocking of services to integrated security, telephone and remote worker/office connections.

Features of Firewalls

Blocking Unauthorised Access from the Internet
The basic job of the majority of firewalls is to block unauthorised access from the internet i.e. to stop hackers from getting in to your network and computer system.

Allowing Authorised Access from the Internet
If you have an email server such as Microsoft Exchange, Web Server, Citrix or Terminal Server or another service that requires access from the internet your firewall will need to divert the relevant traffic to that service.  Some firewalls will let the other server deal with any security issues that may occur in its traffic such as user authentication other more advanced firewalls will provide various levels of security before forwarding the traffic thus providing additional security to your network.

Employee’s Access to the Internet & Content Filtering
More advanced firewalls can allow certain user’s access to the internet and block others.  Some can also provide content filters which filter the types of website that they access, for example limiting access for some user’s to only specific work related websites (at all times or during only during office hours).  Other organisations allow all websites to be accessed except those that may pose a threat or are definitely not work related sites (such as pornography websites).  Also an important feature is to filter types of file that can be accessed or downloaded, web pages and documents maybe normal work activity but Programs and Music (such as MP3) files may not be and can be limited.

Branch Offices & Mobile/Remote Workers
Many Firewalls now integrate Virtual Private Networking or VPN access to the network.  VPN provides remote access to the network such as:

Branch offices Home Workers Mobile Workers

More advanced firewalls can specify the type of access that each remote office or worker can access, this is useful for many security reasons.

Internet Acceleration (or Caching)
The more people and services we have using an internet connection at one time the more bandwidth is required.  Bandwidth is the speed at which you connect to the internet similar to a Motorway if you have too many cars you get congestion.  Broadband ADSL or Cable connections can be relatively inexpensive but if you require more connections or more advanced & reliable connections the bill will soon build up.  Internet Acceleration firewalls or Caching Firewalls can download specific content once either when a user accesses it or at a specific time (for example out of office hours / off peak), when more than one person requires access to that content it supplies the cached content rather than downloading it from the internet again, thus saving internet bandwidth.  This can be a considerable saving especially if many staff members access the similar content regularly.

Telephone and Voice over IP (VoIP) Services
Again a regular offering from all levels of firewalls are Telephone and VoIP services.  VoIP sends telephone traffic over the internet rather than down your phone line, if it is to another VoIP phone (for example a home worker, branch office or another company with VoIP) it will usually be a free call.  If the call is to a mobile or landline number that is not Voice over IP then you can subscribe to a service that is often cheaper than using your landline to make call.  These firewalls can often be plugged into your current telephone system.  More advanced firewalls can provide ‘least cost routing’ to direct the call via the cheapest method and handle times when your internet connection is not working or congested.

Firewalls are a necessity for all connections home users and companies alike.  The type of firewall and how it is configured can have significant impact on your security and provide many benefits.