Firewalls, IDS and IPS Explained for Beginners

Firewalls, intrusion detection systems (IDS) and intrusion prevention systems (IPS) are the first tools every defender meets, and they are easy to mix up. This guide explains what each does, how they differ and how to try a firewall safely in a lab you own.

Firewall: The Gatekeeper

A firewall allows or blocks network traffic according to rules, usually based on source, destination, port and protocol. A basic rule might read: allow web traffic to the web server, block everything else. Modern firewalls can also track connections and inspect traffic by application, but the idea stays the same: decide what gets through.

IDS: The Alarm

An intrusion detection system watches traffic or logs and raises an alert when something looks like an attack: a known malicious pattern, a scan, or behavior that does not match normal. It does not block anything. Someone must read the alert and act. Snort and Suricata are two widely used open-source engines.

IPS: The Alarm That Also Blocks

An intrusion prevention system sits in the path of traffic and can drop a connection when it matches a rule. That makes it faster than a human, but it also means a bad rule can block legitimate users. Teams usually run a new rule in detect-only mode first, then switch it to block once they trust it.

The Differences at a Glance

• Firewall: enforces who may talk to whom. Preventive.
• IDS: raises alerts about suspicious activity. Detective, passive.
• IPS: raises alerts and blocks matching traffic. Preventive, inline.
• Web application firewall (WAF): a firewall specialized for web requests, aimed at flaws such as SQL injection; see SQL injection explained.

Where They Sit

A typical design puts a firewall at the edge between the internet and the company, more firewalls between internal segments, and IDS or IPS sensors where traffic is worth watching. Segmentation matters because an attacker who gets into one segment should not reach everything else; our pivoting guide shows why.

Try a Firewall in Your Own Lab

On an Ubuntu virtual machine you own, the Uncomplicated Firewall (ufw) makes the idea concrete. Allow your remote access first so you do not lock yourself out, then block everything else inbound:

• sudo ufw allow 22/tcp
• sudo ufw default deny incoming
• sudo ufw enable
• sudo ufw status verbose

Now scan the machine from another VM with nmap (see Nmap for beginners) and compare what you see with the firewall off and on. Then open a port deliberately and scan again. Seeing the difference teaches more than reading about it.

What They Still Miss

• Traffic that is encrypted, unless the device can inspect it.
• Attacks that use allowed ports, such as web traffic carrying a malicious request.
• Stolen valid credentials. A correct login looks normal.
• Anything that a poorly tuned rule lets through, or noisy alerts that analysts learn to ignore.

That is why defenders add logging, a SIEM and people who investigate; see Splunk vs Wazuh and our guide to what a SOC analyst does.

Where This Fits

Perimeter security is module 4 of the EC-Council CND syllabus; the CND exam guide lists all 20 modules.