How Firewalls Work: Your Network's Gatekeeper Explained

What Is a Firewall?

A firewall is a network security system that monitors and filters network traffic based on preset rules. Analogy: like a security guard at a gated community checking everyone entering or leaving — residents (legitimate traffic) pass, strangers (suspicious traffic) are questioned, wanted criminals (malicious traffic) are blocked. The firewall inspects network packets instead of people.

Types of Firewalls

By Implementation

Software firewall : installed on a computer (e.g., Windows Firewall). Pros: free, convenient. Cons: protects only that computer.

Hardware firewall : dedicated device at network perimeter. Pros: protects entire network, high performance. Cons: higher cost, requires professional configuration. Enterprises often deploy both for defense in depth.

By Technical Principle

Packet-filtering firewall (most basic): examines packet headers — source IP, destination IP, port, protocol — and applies a rule table. Analogy: guard checks only ID — where from, where to, which door. Pros: fast, low resource use. Cons: sees only "envelope," not content; cannot detect complex attacks.

Stateful inspection firewall : tracks connection state; only allows return packets belonging to established connections. Analogy: guard records when you left and who you visited; verifies you're the same person returning.

Application-layer firewall (most intelligent): inspects packet payload, understands application protocols (HTTP, FTP), can filter web content or specific file types. Analogy: guard opens your package to see what's inside.

Firewall Rules

Rules decide allow or deny. Each rule typically includes:

Source address — where data originates (e.g., 192.168.1.0/24)

Destination address — where data goes (e.g., 10.0.0.5)

Port number — which service (e.g., 80 for HTTP, 443 for HTTPS)

Protocol — TCP, UDP

Action — ALLOW or DENY

Example: Allow internal network (192.168.1.0/24) to access web server (10.0.0.5) via TCP port 80.

Rules are matched sequentially from top to bottom; the first matching rule takes effect, so rule order matters.

Default Policy: Allow or Deny?

If a packet matches no rule, the default policy applies. Two options:

Default allow : everything not explicitly blocked is permitted. Lower security but fewer connectivity issues.

Default deny : everything not explicitly allowed is blocked. Higher security but requires careful rule configuration.

Security best practice: default deny — open only necessary ports and services.

What Firewalls Can and Cannot Do

Can do:

Block unauthorized external access

Restrict internal users from accessing specific sites/services

Prevent external scanning and probing

Log and audit network traffic

Cannot do:

Stop viruses (needs antivirus software)

Prevent malicious actions by insiders

Encrypt data (needs VPN or encryption protocols)

Stop all attack types (e.g., social engineering)

Firewalls on Home Computers

Windows and macOS include built-in firewalls enabled by default. They:

Block unauthorized external programs from accessing your computer

Prompt when a new program first tries to connect to the network

Filter common network scans

Most home routers also provide basic firewall protection for all devices on the network.

Key Exam Points (Software Qualification)

Firewall definition and function

Firewall classification: packet filtering, stateful inspection, application layer

Access Control List (ACL) basics

Default policy (default allow vs. default deny)

Firewall limitations

Summary

A firewall is the network's "gatekeeper," using rules to decide which traffic passes and which is blocked. It is the most fundamental network security perimeter — while it cannot solve every security problem, operating without one is like leaving the door wide open. Remember: firewall + antivirus + good usage habits = basic security baseline.