What's the state of firewalls today — typical deployment, products, and the role of NAT in home networks?
Today, all firewalls are stateful by default. Deployed mostly as vendor appliances with hardened OS, increasingly also as virtual appliances in cloud environments. Home/SOHO networks rely on NAT in the router for "firewall-like" protection — not real FW rules.
The five "today" facts:
| # | Fact | Detail |
|---|---|---|
| 1 | All firewalls today are stateful | Pure stateless packet filters are obsolete |
| 2 | Application Gateways used in specific scenarios | Web proxies, email gateways — not as primary network FW |
| 3 | Sold mostly as appliances | Hardware + hardened OS pre-integrated |
| 4 | Increasingly virtual appliances | VM in VMware/Hyper-V, container in K8s, function in cloud |
| 5 | SOHO uses NAT, not real firewall | Home routers rely on NAT side-effect for "security" |
The NAT-as-firewall trap:
Without IPv4 NAT: With IPv4 NAT:
Internet → Public IP → device Internet → Public IP → router → 192.168.x.x devices
(NAT translation)
Direct addressability No direct addressability — incoming connections
of every device have no idea which 192.168.x.x to reach
The "security" of NAT is incidental — it happens because NAT can't route incoming connections without an explicit mapping (port forwarding). This looks like a firewall but isn't:
- No rules engine — it's just routing behavior.
- Once a hole is opened (UPnP, port forwarding), it's permanent until closed.
- IPv6 doesn't have NAT — every device has a public address. Without a real firewall, every IoT device is exposed.
The IPv6 transition implication:
Many SOHO routers add basic firewall rules for IPv6 because NAT-as-firewall doesn't apply. Without those rules, your IoT camera on IPv6 would be directly addressable from the Internet. Always check that your home router has IPv6 firewall enabled.
Open-source FW software:
- pfSense — FreeBSD-based, strong commercial backing (Netgate)
- OPNsense — pfSense fork, more open governance
- IPFire — Linux-based, German project
These give you enterprise-grade FW capabilities for the cost of a $200 mini-PC. They're regularly used in:
- Home labs and small businesses
- Educational environments
- Cost-sensitive deployments
Personal Firewalls integrated in OS:
- Linux iptables / nftables — kernel-level, powerful, complex
- Windows Defender Firewall — integrated, simple-to-use, AD-aware
- macOS Application Firewall — basic but functional
- iOS / Android — minimal user-controlled firewall; OS-level isolation does most of the work
Tip: For home use, the order of priority: 1) ensure your router has WPA3 WiFi and a strong admin password, 2) ensure the OS-level firewall is on, 3) only worry about a separate FW if you're hosting services. The router's NAT + OS firewall covers 95% of home use cases.
Go deeper:
Network address translation — Wikipedia — explains why NAT blocks unsolicited inbound connections as a side-effect (the "NAT-as-firewall" illusion) and why IPv6 removes it.