Firewalls Explained: NGFW vs WAF vs FWaaS

"We have a firewall" is one of the most misleading sentences in security, because it hides a question: a firewall protecting what? The tool that stops malicious traffic reaching your servers is not the tool that stops SQL injection reaching your website, and neither is the same as the cloud service that protects a fleet of remote workers. Confusing them is how organisations end up with a locked front door and an open web app.

This article sits under Cybersecurity Basics and completes the architecture trio alongside identity and access management and zero trust architecture.

What a firewall does

At its core a firewall inspects traffic and decides, by policy, what to allow and what to block — a controlled boundary between zones of different trust. The earliest firewalls were packet filters that judged traffic on source, destination and port alone. Stateful firewalls improved on that by tracking the state of each connection, so a reply is recognised as part of a conversation the inside started. That stateful model is the baseline every modern firewall builds on — and where the three types below diverge is in what they inspect and where they sit.

From packet filter to NGFW

A next-generation firewall (NGFW) is a network firewall that looks beyond ports and addresses. On top of stateful inspection it adds:

• Application awareness — recognising the actual application in the traffic (Salesforce, BitTorrent, a database protocol) rather than just "port 443".
• Integrated intrusion prevention (IPS) — matching traffic against known attack signatures and blocking it inline.
• Deep packet inspection, often including TLS/SSL inspection so encrypted traffic can be examined rather than waved through.
• Threat intelligence and user identity — feeds of known-bad indicators, and rules written by user or group rather than IP.

An NGFW is where you control traffic between zones — the internet edge, and increasingly the segment boundaries inside a network. It is the workhorse of network security, but it watches the network, not the logic inside your applications.

Web application firewall (WAF)

A web application firewall (WAF) does a fundamentally different job: it sits in front of a specific web application or API and inspects the HTTP requests reaching it, at layer 7 (the application layer). Where an NGFW asks "should this traffic be on the network?", a WAF asks "is this web request trying to attack my app?" — looking for the injection, cross-site-scripting and abuse patterns catalogued in the OWASP Top 10.^[3]

This is the distinction buyers most often miss: an NGFW will happily pass a perfectly valid-looking HTTPS request to your web server, and that request can still carry a SQL-injection payload the NGFW is not designed to understand. Stopping it is the WAF's job. A WAF is closely related to API security — modern WAFs increasingly protect APIs as well as browser-facing apps.

Firewall-as-a-service (FWaaS)

Firewall-as-a-service (FWaaS) is not a new kind of inspection but a new delivery model: firewall capability delivered from the cloud as a service rather than as a box you rack in a data centre. It matters because the shape of the network changed — users, branches and workloads are now everywhere, and backhauling all their traffic to a central appliance to be inspected is slow and expensive. FWaaS inspects traffic in the cloud, close to the user, and scales elastically with demand. It is a core component of SASE, the model that combines cloud-delivered networking and security, and it is how most distributed organisations now consume firewalling.

NGFW vs WAF vs FWaaS

The distinctions in one view — the reason this article exists:

Firewalls and zero trust

A firewall is an enforcement point — the gate that lets traffic through or stops it — not a whole security strategy. In a zero trust architecture, firewalls and microsegmentation enforce the rules, but the decision comes from identity, device posture and context, evaluated per request. A single perimeter firewall with a soft interior behind it is exactly the model zero trust moves beyond. The modern pattern is many small enforcement points — network firewalls between segments, WAFs in front of apps, FWaaS around distributed users — all applying one identity-driven policy.

Firewalls in Singapore

For regulated firms, network firewalls and segmentation are not optional. The Monetary Authority of Singapore (MAS) sets out network-security expectations in its Technology Risk Management Guidelines — firewalls at network boundaries, segmentation of sensitive systems, and intrusion prevention among them.^[1] A design that treats the internal network as a single flat, trusted zone will not satisfy them.

For smaller organisations, CSA's Cyber Essentials mark makes the baseline concrete. Its "Secure/Protect" measure covers guarding against malware, enforcing access controls and configuring systems securely — with a correctly set-up firewall and secure network configuration among the essentials expected of any organisation.^[2] And any internet-facing application handling personal data under the PDPA is a natural candidate for a WAF, whatever the network firewall in front of it already does.

How to choose

Match the tool to what you are actually protecting, and avoid the mistakes that leave gaps:

1. Protecting the network? That is an NGFW — at the edge and between internal segments.
2. Protecting an internet-facing web app or API? That is a WAF, in addition to the network firewall, not instead of it.
3. Users and workloads spread across cloud and branches? FWaaS — usually as part of a SASE rollout — avoids backhauling everything to an appliance.
4. Turn on what you paid for. An NGFW with IPS, TLS inspection and threat feeds left switched off is just an expensive stateful firewall.
5. Review the rules. Firewall rule sets rot — stale allow rules are a standard audit finding. Review and prune them on a schedule.
6. Remember it is one enforcement point. Firewalls are necessary, not sufficient; pair them with strong identity and a zero-trust design.

Sizing up firewalls or a SASE rollout?

The right mix of NGFW, WAF and FWaaS depends on what you run and where. Compare Singapore cybersecurity providers and managed security services that design and run network defences.

Browse Cybersecurity Providers in Singapore

Frequently asked questions

Sources

1. Technology Risk Management Guidelines — Monetary Authority of Singapore — MAS official checked 2026-09-01
2. Cyber Essentials and Cyber Trust marks — Cyber Security Agency of Singapore — CSA official checked 2026-09-01
3. OWASP Top 10 — Open Worldwide Application Security Project — OWASP official checked 2026-09-01