"A device or program that controls the flow of network traffic between networks or hosts that employ differing security postures." (SP 800-41 Rev. 1)