What is a firewall, and what is the difference between IDS and IPS?

A firewall controls traffic between network segments based on rules. Types, in increasing sophistication:

• Packet filtering — decisions on source and destination address, port, and protocol. Fast, but no awareness of connection state.
• Stateful inspection — tracks connection state, so return traffic for an established connection is permitted automatically. The standard baseline.
• Next-generation firewall — adds application awareness, user identity, and integrated threat inspection, so it can distinguish traffic beyond port numbers.
• Web application firewall (WAF) — operates at the HTTP layer specifically, filtering application attacks such as injection attempts.

IDS versus IPS:

• IDS (Intrusion Detection System) is passive. It monitors a copy of traffic and alerts. It cannot block, but it also cannot break anything — no risk of a false positive dropping legitimate traffic.
• IPS (Intrusion Prevention System) is inline and active. Traffic passes through it and it can drop malicious packets. It stops attacks in real time, but a false positive becomes an outage, and it is a potential bottleneck and point of failure.

Detection methods for both: signature-based (matching known patterns — reliable but blind to novel attacks) and anomaly-based (deviation from a learned baseline — can catch new attacks but produces more false positives).

Note: The practical deployment answer is that organisations often run IPS in detection mode first, tune the rules against real traffic, then enable blocking selectively.