Firewall
Filters network traffic against a rule set, allowing or denying connections to protect workloads.
Description
Cloud firewalls come in two tiers: instance/subnet-level stateful filters (AWS Security Groups, GCP VPC firewall rules, Azure Network Security Groups) and managed network firewalls for deeper inspection (AWS Network Firewall, Azure Firewall). The basic allow/deny-by-port-and-address model is equivalent across providers; differences are in rule scoping (attached to instances, subnets, or the VPC/VNet), default behaviour, and how logging and centralised management work. Dedicated firewall appliances offer richer deep-packet inspection at the cost of self-management. To the best of our knowledge these are comparable primitives; pick based on the granularity and inspection depth you need.
Capabilities
- Allow/deny by port, protocol, and address
- Stateful connection tracking
- Ingress and egress rules
- Logging of allowed/blocked traffic