What Is a Firewall and How It Works
SkillVeris Team
Cloud & Security Team
A firewall is a security barrier that inspects incoming and outgoing network traffic and allows or blocks it based on a set of rules you define.
In this guide, you'll learn:
- Firewalls filter on attributes like source and destination IP, port, and protocol, enforcing a boundary between trusted and untrusted networks.
- Stateful firewalls track the state of connections, so replies to traffic you started are allowed automatically while unsolicited traffic is dropped.
- A default-deny policy — block everything, then allow only what you need — is far safer than trying to block known-bad traffic one rule at a time.
- Next-generation firewalls add deep packet inspection, application awareness, and intrusion prevention beyond simple port filtering.
1What Is a Firewall?
A firewall is a security system that monitors network traffic and decides, packet by packet, what to allow through and what to block based on rules you set. It sits at the boundary between a trusted network — like your home or company LAN — and an untrusted one, such as the internet.
The name comes from the physical fire-resistant walls that stop flames spreading between buildings. A network firewall plays the same role: it contains threats and prevents unwanted traffic from moving freely between zones. Everything that crosses the boundary is checked against the ruleset first.
2Why Firewalls Matter
A firewall is the first line of network defence, shrinking the surface an attacker can even reach.
- Reduces attack surface: closed ports simply do not respond, so services you never exposed cannot be probed.
- Enforces policy: only approved traffic — say, web traffic on ports 80 and 443 — is permitted.
- Segments networks: isolates sensitive systems so a breach in one zone does not spread.
- Provides visibility: logs of allowed and denied traffic help you spot scans and intrusions early.
🔑Key Takeaway
A firewall does not make a system unhackable — it removes the easy paths in, forcing attackers to work harder and giving you a record when they try.
3How a Firewall Works
A firewall inspects each packet and compares it against an ordered list of rules, acting on the first rule that matches. The attributes it reads determine whether the packet is allowed, dropped, or rejected.
- Source and destination IP address: where the packet came from and where it is headed.
- Port number: which service is being contacted, such as 22 for SSH or 443 for HTTPS.
- Protocol: TCP, UDP, or ICMP, among others.
- Direction: inbound to your network or outbound from it.
- Action: allow, drop (silently discard), or reject (discard and notify).
First Match Wins
Rules are evaluated top to bottom, and the first match decides the outcome. This is why rule order matters: a broad allow rule placed above a specific deny rule will let traffic through before the deny is ever reached.
4Stateful vs Stateless Firewalls
Firewalls come in stateless and stateful varieties, and the difference shapes how smart they are about ongoing connections.
- Stateless: inspects each packet in isolation against static rules. Fast and simple, but blind to context.
- Stateful: tracks active connections, so it knows a packet is a reply to something you sent.
- Because stateful firewalls remember state, they can auto-allow return traffic without a separate inbound rule.
- Almost all modern firewalls are stateful, from the Linux kernel to enterprise appliances.
Why State Helps
When you request a web page, your machine opens a connection outbound. A stateful firewall records that and automatically lets the response back in, while still blocking unsolicited inbound connections. A stateless firewall would need an explicit, broader rule to allow the reply.
5Types of Firewalls
Firewalls exist at different layers and in different forms, and most networks use more than one together.
- Packet-filtering firewall: the basic form, filtering on IP, port, and protocol.
- Stateful inspection firewall: adds connection tracking for smarter decisions.
- Application/proxy firewall: inspects traffic at the application layer and can filter by content.
- Next-generation firewall (NGFW): combines deep packet inspection, application awareness, and intrusion prevention.
- Host-based firewall: runs on a single machine (e.g. Windows Defender Firewall, Linux ufw); network firewalls guard whole segments.
💡Pro Tip
Use both: a network firewall at the perimeter and a host-based firewall on each machine. Layered filtering means a mistake in one does not leave a system fully exposed.
6Configuring a Firewall Safely
Configuring a firewall well starts with a default-deny stance: block everything, then open only the specific ports your services genuinely need. Here is a typical Linux ufw setup that demonstrates the pattern.
- sudo ufw default deny incoming # block all inbound by default
- sudo ufw default allow outgoing # allow outbound traffic
- sudo ufw allow 22/tcp # permit SSH so you do not lock yourself out
- sudo ufw allow 443/tcp # permit HTTPS for a web server
- sudo ufw enable # activate the firewall
⚠️Watch Out
Always allow your SSH or management port before enabling a remote firewall. Enable a default-deny policy without it and you can lock yourself out of the server entirely.
7Common Mistakes to Avoid
Firewalls are only as good as their configuration. These errors weaken otherwise sensible setups.
- Leaving a default-allow policy, so anything not explicitly blocked gets through.
- Opening broad port ranges when a single port would do.
- Getting rule order wrong, letting a permissive rule override a later deny.
- Never reviewing logs, so scans and probes go unnoticed.
- Treating the firewall as complete security and skipping patching, authentication, and monitoring.
8Key Takeaways
The core ideas of firewalls fit into a few durable principles.
- A firewall filters traffic against rules, forming a boundary between trusted and untrusted networks.
- It decides using IP, port, protocol, and direction, with the first matching rule winning.
- Stateful firewalls track connections and auto-allow replies to traffic you started.
- Default-deny — block all, allow only what you need — is the safest baseline.
- A firewall is one layer; combine it with patching, authentication, and monitoring.
9Frequently Asked Questions
Q: What is the difference between a firewall and antivirus? A: A firewall filters network traffic entering and leaving a system, deciding what connections are allowed. Antivirus scans files and programs already on a device for malicious code. They protect at different layers and work best together.
Q: What is the difference between dropping and rejecting a packet? A: Dropping silently discards the packet with no reply, so a scanner sees no response at all. Rejecting discards it but sends back an error notice. Dropping is usually preferred because it reveals less about your system.
Q: Do I still need a firewall behind a home router? A: Your router already includes a basic firewall via NAT, which hides internal devices. A host-based firewall on each machine adds a second layer, which is valuable on shared or public networks and against threats already inside the LAN.
Q: What is a next-generation firewall? A: An NGFW goes beyond port and IP filtering to inspect the actual content and application of traffic, block known intrusion patterns, and identify apps regardless of port. It combines several security functions into one system.
Related Reading
Get The Print Version
Download a PDF of this article for offline reading.
About the Publisher
SkillVeris Team
Cloud & Security Team
Our cloud and security experts break down complex infrastructure topics into practical, beginner-friendly guides.
View all postsRelated Posts
Never miss an update
Get the latest tutorials and guides delivered to your inbox.
No spam. Unsubscribe anytime.