What Is a Firewall and What Does It Block?

TL;DR

• A firewall controls which network traffic is allowed to pass between networks or devices, based on rules [1][2].
• A network firewall guards the boundary of a whole network, such as your home router. A host firewall is software on a single device.
• It can block traffic from certain addresses, apps or ports.
• It is not a complete defense. It mainly guards against malicious traffic, not malware you install or run yourself [3].

What a firewall does #

The name comes from the wall that stops a fire spreading between parts of a building. In computing, NIST defines a firewall as a device or program that controls the flow of network traffic between networks or hosts that have different security postures [1]. Another NIST definition puts it as a gateway that limits access between networks in line with a security policy [1].

In practice a firewall works through rules. Each rule says what to allow or deny, using things like the source or destination address, the network port, or the application involved. Microsoft describes its built-in Windows firewall as allowing or blocking connections based on IP addresses, ports and application paths [2]. A new connection that matches an allow rule goes through. One that matches no allow rule can be dropped.

A useful comparison is a security desk at an office building: visitors with a valid reason go through, and others are turned away.

Network vs host firewalls #

CISA calls these hardware and software firewalls. It says hardware firewalls sit between your devices and the internet, while software firewalls are often built into operating systems [3]. Most homes already have both without realizing: the router has a firewall function, and Windows, macOS and many other systems include their own.

What a firewall cannot do #

A firewall is one layer, not a shield against everything. CISA notes that a firewall does not guarantee your computer will not be attacked, and that it mainly guards against malicious traffic rather than malicious software, so it may not help if you accidentally install or run something harmful [3].

Things a firewall generally cannot fix:

• Phishing and scams. If you are tricked into entering your password, no rule can tell.
• Malware you run. A file you open yourself arrives through a connection you allowed.
• Weak passwords and unpatched software.
• Threats already inside the network, which may never cross the firewall.

Strong security therefore combines a firewall with updates, antivirus tools, careful habits and strong, unique passwords [3].

Sensible habits #

• Keep your operating system's built-in firewall switched on, even if your router has one [3].
• Review the default settings, because they are often looser than necessary [3].
• Get any extra firewall software only from reputable vendors.
• Do not disable the firewall just to make one program work. Add a narrow rule for that program instead.

FAQ #

Do I need a firewall at home? #

Yes, in practice you almost certainly have one. Home routers include basic filtering, and modern operating systems include a software firewall. Leave them on.

Is a firewall the same as antivirus? #

No. A firewall filters network traffic. Antivirus looks for harmful files and behavior on the device. They cover different gaps, which is why they are used together [3].

Can a firewall stop hackers completely? #

No. It reduces exposure by blocking unwanted connections, but it does not protect against tricks such as phishing or malware you run yourself [3].

What is a next-generation firewall? #

It is a name vendors use for firewalls that inspect more than addresses and ports, such as the application in use. The exact features vary by product.

Sources #