There are a lot of hardware firewalls out there, but what is their advantage / use over software firewalls, as I can also easily set those up without having to buy pricy hardware firewalls?

Are there any reasons for choosing a hardware firewall over a software firewall?

  • 1
    Are you asking about software firewalls that run as an application or software used to create a firewall appliance? I ask this because of the way your question is worded. – John Gardeniers Nov 7 '09 at 17:50
  • You'd have to find a hardware firewall first; to the best of my knowledge there are no firewalls that are entirely defined in hardware. – womble Nov 7 '09 at 23:56
  • @wobble: You are correct that the name is a misnomer, but the term hardware firewall generally means a separate, standalone appliance whose sole job is firewall & related. – OMG Ponies Nov 8 '09 at 22:54

All firewalls are software.

Hardware firewalls

...are a physically separate entity, using dedicated hardware. Because they are a specialized device, the hardware & software is minimized in an effort to make them more secure. The less there is to exploit, the less chance of being exploited...

The cost effective alternative is to setup a *nix/BSD box, using:

  • Pentium 100+
  • 1+ GB hard drive
  • 2 Network Interface Cards (NICs)
  • 1+ wireless adapters

I recommend using OpenBSD & PacketFilter (PF), assuming that's still current. Otherwise look at Linux's IPTables.

What you get when you buy a hardware firewall from a vendor is a turn-key solution. You unbox it, plug it in, login & configure what rules you need. If there's an update, you apply the patch/firmware. You get a nice web interface GUI. But these days, software like DD-WRT provides the same stuff on your router/firewall...

Software firewalls

...reside on the host itself. Because they have to be accessible to the user, they can be turned off at will (permissions allowing). And because they reside on an OS tailored to users, more services are on - increasing the possibility of exploitation/circumvention.

If you're really concerned with security

...you'd employ the "onion" defence: You implement multiple layers of security, by having both a hardware firewall and software firewalls on each host in your network.

  • Firmware is not generally considered software, so I don't agree that all firewalls are software. en.wikipedia.org/wiki/Firmware – Scott Lundberg Nov 8 '09 at 13:38
  • Quoted from wikipedia: "No strict or well-defined boundaries separate firmware from software; both are quite loose descriptive terms." – OMG Ponies Nov 8 '09 at 20:52
  • Computer software is often regarded as anything but hardware, meaning that the "hard" are the parts that are tangible while the "soft" part is the intangible objects... – OMG Ponies Nov 8 '09 at 20:55
  • Programs & data structures that control electronic devices is software. You're still converting instructions to machine language & back... – OMG Ponies Nov 8 '09 at 20:58
  • @Rexem: yes, I read that part about well-defined boundaries, which is why I said "not generally considered software", thus the term firmware. In the context of the OP question, examples of software firewalls are the personal firewalls like BlackIce, Norton, McAfee, etc. whereas hardware firewalls are built by Cisco, Sonicwall etc. We can get into an argument about software vs. hardware, but it won't further the answer to the original question... – Scott Lundberg Nov 8 '09 at 21:40

Hardware firewalls as a general rule tend to be more reliable and faster. Since the manufacturer can choose/build the OS, they can make it very specific to supporting a firewall. Software firewalls don't have this luxury. They are dependent on the OS they are installed on.
That being said, there are many good software firewalls. Some, like iptables, are even free. If you are looking to protect a medium to large business network, then IMO you should choose a hardware firewall.
I think you hit the nail on the head with your question, it's really the same question: you get what you pay for.

EDIT: Another thing that should matter to you is ICSA certification. There are about 20-25 hardware firewalls on this list and about 50 software firewalls, including personal firewalls.

  • 1
    +1 Good points here, especially the ICSA bit – squillman Nov 7 '09 at 16:47
  • 2
    ICSA certification is just a rubber stamp to make sure you buy vendor products before considering *nix/BSD. You won't find OpenBSD or *nix IPTables on the list, though many of the products are using that under the covers. – OMG Ponies Nov 7 '09 at 17:30
  • Rexem: It's also a good way for someone who is not a firewall expert to know that it has gone through some good testing. Since IPTables is configured completely by the user, I agree it will never be on the ICSA list... – Scott Lundberg Nov 7 '09 at 18:35
  • @Rexem of course iptables won't be ICSA certified, as it is completely configured by the user. – phoebus Nov 7 '09 at 20:08
  • @phoebus: And you can't configure an ICSA certified device? ;) – OMG Ponies Nov 8 '09 at 1:11

In my experiences it's mainly a maintenance issue. Hardware firewalls by and large come with everything pre-installed (OS on up), just plug it in and you're close to having a functional unit. Many of them will also come with options that will let you quickly define your policy rules and whatnot in order to get you going quickly.

Updating them is typically just a matter of applying a firmware update. This is often a big advantage since all of the patching and updates are really done by the vendor, you just have to load the patched image.

In my opinion, it just depends on your environment, experience and your needs whether or not there's a real advantage.


It's really the same... the difference is whether it's delivered as an appliance or not - ie a branded box ready-to-go.

Most firewalls are available in both incarnations and examples are IPTables and Microsoft ISA - both available as just another software package or as certified appliances that are specifically configured to be a firewall - ie the "hardware" style.

Obviously all sorts of accelerator logic can be built into an appliance as long as the software supports it, like specific encryption chips to lessen the burden of common encryption tasks from the main processor. Whether this is still sane I'm not sure, as generic processing power in say x86 server hardware is high these days.

Patch management with an appliance can actually be trickier as it may not fit into your normal patch management platform and require special procedures. Too often patching of appliances/hardware firewalls are left out of the loop entirely for some strange reason.

  • It's a separate box, meaning that you won't have anyone using it as a working OS too (also possible to achieve with software, but hardware completely removes the risk).
  • The OS can be tuned, modified, extended and/or hardened by the vendor for the specific purpose of running as a firewall, whereas a software firewall goes on a general-purpose OS which must have any such modifications retro-fitted, if at all.
  • It's a complete package with the various components specifically designed to work together, so you can be more certain of overall reliability.
  • It's a one-stop-shop solution, so you don't get the application vendor blaming the OS or the OS vendor blaming the hardware or the hardware vendor blaming the application if things go wrong.
  • The risk of patches or modifications to one component affecting the rest of the system in unexpected ways is reduced or removed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.