What Is a Firewall? How It Filters Traffic and Protects Your Network
✦ Key takeaways
- A firewall inspects data packets and decides to allow or block them based on defined rules.
- There are four main types: packet filtering, stateful inspection, application/proxy firewalls, and next-generation firewalls.
- A firewall can be software on a single device or a dedicated appliance protecting an entire network.
- Ports and rules are the language a firewall uses to define what traffic is permitted.
Picture your home or company network as a building with a single door connecting it to the outside world — the internet. Every day, thousands of requests pass through that door: web pages, emails, software updates, and occasionally malicious attempts. A firewall is the guard standing at that door, examining every incoming or outgoing request and deciding, based on a predefined set of rules, whether to let it through or reject it.
The term itself is borrowed from the physical walls built between sections of buildings to stop fires from spreading. A digital firewall serves a similar purpose: isolating a trusted network (like your internal LAN) from an untrusted one (the open internet), and preventing dangerous or unauthorized data from crossing between them.
Invoice & Quotation Maker
Professional invoices that auto-calc & print/PDF in a minute.
How a Firewall Inspects Traffic
Every piece of information traveling across the internet is broken into small units called packets. Each packet carries essential information in its header: the source IP address, the destination IP address, and the port number being used. A port is a number that identifies the type of service; for example, port 80 is typically used for unencrypted web browsing (HTTP), port 443 for encrypted browsing (HTTPS), port 22 for secure remote access (SSH), and port 25 for email (SMTP).
The firewall compares each packet's information against a set of predefined rules. A typical rule might state: 'allow all outbound traffic on port 443' or 'deny any inbound connection on port 3389 from outside the local network.' If a packet doesn't match any explicit allow rule, the safe default policy is to reject it automatically — a principle known as Default Deny.
The Main Types of Firewalls
Firewall technology has evolved over decades to become smarter about understanding the context of traffic, not just its surface-level numbers. The table below summarizes the four core types:
| Type | How It Works | Typical Use Case |
|---|---|---|
| Packet Filtering | Examines each individual packet (IP address, port, protocol) without remembering previous packets | A simple home router blocking unused ports |
| Stateful Inspection | Tracks the full state of a connection (start, ongoing, end) and evaluates packets against session context | The standard firewall type in most enterprises today |
| Application/Proxy Firewall | Inspects the actual content of data at the application level (e.g., HTTP requests) and acts as an intermediary between user and server | Blocking specific websites or inspecting web content in corporate networks |
| Next-Generation Firewall (NGFW) | Combines stateful inspection, application awareness, intrusion prevention (IPS), and behavioral analysis | Protecting data centers and large enterprise networks |
Software vs. Hardware Firewalls
A software firewall is an application installed on an individual device (a computer or phone) that controls the traffic entering and leaving that specific device — such as the built-in firewall found in modern operating systems. A hardware firewall, on the other hand, is a standalone device placed at the network's connection point to the internet (often built into a router or as a separate appliance), protecting every device connected to that network at once.
At home, the router's built-in firewall combined with each device's software firewall is usually sufficient. In enterprise environments, a dedicated hardware firewall is typically deployed at the network perimeter, in addition to software firewalls on sensitive servers — an approach known as Defense in Depth, where security never relies on a single layer alone.
Practical Rule Examples
To make this concrete, here are simplified examples of common rules a network administrator might set: allow outbound HTTPS traffic (port 443) for everyone, allow outbound mail traffic (port 587) only from the mail server, deny any inbound connection on remote administration ports (such as 3389 or 22) except from specific known IP addresses, and deny everything else by default. Together, these rules form the 'firewall policy' that defines what a secure network is allowed to look like.