Firewall vs Intrusion prevention system (IPS)

Why they differ

A firewall decides by fixed rules about where traffic may go; an IPS looks inside allowed traffic for signs of an attack.

Firewall

Networking

A gatekeeper that checks network traffic against rules and lets through only what is allowed.

Formal

A device or program placed between networks that inspects each packet - its IP addresses, ports and protocol - and allows or blocks it according to a set of rules. Most firewalls also track open connections, so replies to allowed traffic are let back in.

In plain English

Like a guard at the gate of a building with a list of who may come in and which doors they may use; anyone not on the list is turned away.

In practice

At a local water utility, the IT operations manager sets the firewall so the system that controls the pumps can be reached only from two computers in the control room; all traffic from the office network is blocked.

Why it matters

It is one of the oldest and most basic network controls, shrinking what an outsider can reach - but it cannot stop threats that come through allowed doors.

Intrusion prevention system (IPS)

Controls & technical basics

A guard placed in the path of network traffic that recognises signs of an attack and blocks them as they happen.

Formal

A system placed directly in the flow of network packets that checks each against known attack patterns or unusual behaviour and drops or cuts off the traffic it judges harmful before it reaches its target.

In plain English

Like a bouncer at the door who turns away anyone matching a description, instead of just phoning the police.

In practice

An outside server sends a request built to abuse a known flaw in a municipality's self-service site for citizens; the IPS recognises the pattern and drops it, and the network team sees only a blocked entry in the log.

Why it matters

It stops attacks without waiting for a human, but a wrong judgement blocks real users too - so rules must be tuned to balance safety against availability.

Shared connections

Packet Security control