Is a hardware firewall needed for a local network without access to other networks?

The local network only consists of a server with SQL database, workstations & PLC controllers.

I am asking this because Stateful and Deep Packet Inspection is part of the project cybersecurity requirement.

  • 1
    Hold on, your new information radically changes the question. If DPI is the requirement, then you need to justify that, not a "firewall". Yes, DPI is performed on a firewall, but it now looks like you need to understand the threats that DPI protects against, not the threats that a firewall protects against.
    – schroeder
    Mar 23, 2018 at 11:46
  • 1
    Why is "Stateful and Deep Packet Inspection" a requirement? That will tell you everything.
    – schroeder
    Mar 23, 2018 at 11:47

3 Answers 3


Firewall used to separate trusted network to untrusted network. If you trust your that insider will not initiate any threat then you don't need firewall. But, users to be very aware. Like, they would not connect any device will any of the device at the inside network's devices. Threat not always comes form Internet. If you network is wireless then attacker could access to your network.


What a firewall does is it regulates the kind of traffic that goes within your network. Regardless of whether internet access exist or not, if you have a need to regulate access, you may need a firewall. A firewall is designed to limit the mobility of an attacker that has managed to gained access (legitimately or illegitimately) to one part of the network from moving to another part of the network.

Unless you start by describing what threat you are concerned with, we can't say whether or not this will be necessary. If, for example, in this closed network users of the system will have unrestricted physical access to all machines, then there's probably not much point for a firewall. But if this restricted network is a large closed loop that consists of an entire building, with different trust boundaries, then firewalls could be beneficial.

Without more details, the most anyone can tell you is: mu.

  • "mu" nice! Although the reference might be lost on most people.
    – schroeder
    Mar 23, 2018 at 13:02

You mentioned PLCs, so I supposed you are talking about some kind of OT network. A FW in those cases does not just help in the packet inspection (which is critical to check the content of the protocols), but in the definition of Operation Zones (Control, supervision, etc.), which are requirement for the compliance with many regulations in the industry field.

Many clients are deploying ruggedized/rugged firewalls in these environments just to help them defined zones, NATing networks (many industrial networks were isolated and the same addressing was used), and to perform DPI.

As I said, I would depend if you are trying to be compliant something, or in the deployment you already have, but a FW would help you in many aspects.

  • can you define "rugerized"?
    – schroeder
    Mar 23, 2018 at 20:37
  • Sorry, I meant ruggedized/rugged. Industrially-Hardened, prepared for harsh-environmnets. Regards
    – bulw4rk
    Mar 24, 2018 at 11:15
  • Please edit your answer to correct it
    – schroeder
    Mar 24, 2018 at 11:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .