Firewall works by filtering packets, using gateways, or application proxies. Packet filtering examines packet contents to allow or block traffic. Circuit-level gateways create virtual connections between inside and outside hosts. Application-level gateways run proxy programs that relay traffic between inside clients and outside servers. Firewalls use static packet filtering rules or dynamic rules that change based on packet contents. Bastion hosts are specially hardened computers that withstand attacks and block outside access to internal networks, working with exterior access routers that monitor individual packets.