Controls and filters network traffic based on security rules. Used for devices that filter up to layer 4 in the ISO OSI model.