What Is a Firewall? How It Allows and Blocks Traffic
A firewall sits at the boundary of a network. It lets through only the traffic that matches rules set in advance, and blocks everything else. It mainly decides by looking at the destination address, the "door number" of the receiving app, and the direction of travel. It is a basic defense against unwanted connections from outside. But it cannot stop attacks that come through an allowed path, or tricks that get you to type in your password.
What you'll learn
- What a firewall looks at when it allows or blocks traffic
- Where firewalls work: home routers, computers, companies and the cloud
- How a firewall lets only replies through (stateful inspection), and how this differs from the NAT in a home router
- What a firewall cannot protect you from
Prerequisites: none. Reading "What Is an IP Address?" and "TCP vs UDP: What's the Difference?" first will make this easier to follow.
In everyday life
When you start a new game, your computer may show a message. It says the firewall has blocked the game and asks whether to allow access. At work, you may hear that "this server can't be reached from outside the company." The word "firewall" also comes up often in security news.
In buildings, a firewall is a fire-resistant wall. It divides a building so that a fire cannot spread to the next room, and the network term borrows that name. But a network firewall is not a wall that blocks everything. It is closer to a gate that chooses what may pass. This article looks at how it makes those choices, step by step.
What a firewall is: a gate at the network boundary
On the internet, data is sent in small chunks. Each chunk is called a packet, and each one starts with a header that holds the destination and other details. "How Is Data Sent Over the Internet?" explains this in more detail.
There is a boundary between a home or company network and the internet. Some devices and software check the header of each packet that crosses it. They decide whether to pass or drop it. This is called a firewall. It decides based on rules that people have set in advance.
Where firewalls are: home, computer, company and cloud
"Firewall" does not only mean a special box. Firewalls are also built into many devices and systems as software.
- Home router: This device sits at the boundary between your home network and the internet. Many models can block traffic that arrives from outside out of the blue.
- Computer: Windows comes with a firewall, and it is on from the start. You can check it under "Firewall & network protection" in the settings. By default, it blocks incoming traffic unless it is a reply you asked for or a rule allows it. Outgoing traffic is allowed unless a rule blocks it.
- Company network: Companies place a dedicated device where their network meets the internet. Web servers open to the public usually go in a separate zone, apart from the internal network. This zone is called a DMZ (demilitarized zone). If a public server is taken over, the attack is less likely to spread inside.
- Cloud: Virtual servers you rent also come with a way to sort traffic by rules. AWS (Amazon's cloud) calls this a "security group." A new one allows all outgoing traffic and starts with no inbound rules at all. "What Is Cloud Computing?" explains how the cloud works.
So some firewalls guard a boundary, and others protect each machine on its own. In practice, both kinds are usually used together.
How it works 1: what it looks at
A firewall mainly looks at three things. The first is the sender's and the destination's IP address. This is the number that identifies a device on a network. See "What Is an IP Address?" for more.
The second is a "door number" that shows which app on the device the traffic is for. This is called a port number. For example, websites using HTTPS use port 443. "TCP vs UDP: What's the Difference?" explains how these numbers are assigned.
The third is the direction of the traffic. Is it coming in from outside, or going out from inside? Rules can also use the type of communication rules, or protocol, such as TCP or UDP.
How it works 2: rules run top to bottom, ending with "block all"
Rules are written as a list in a table. Such a list of what to allow and what to block is called an access control list (ACL). The table below is a simplified example of the rules at the entrance of a small company's network. Port 22 in row 2 is the door for controlling a server from a distance.
| Order | Condition (from where, to where) | Action |
|---|---|---|
| 1 | From outside, to port 443 on the web server | Allow |
| 2 | From head office, to port 22 on the admin server | Allow |
| 3 | From inside, to port 443 outside | Allow |
| 4 | All other traffic | Block |
Many firewalls compare each arriving packet with the table from the top down. The first row that matches decides what happens, and the rows below it are skipped. So a narrow exception must be written above a broader rule.
The key part is row 4, the last one. Any traffic that matches no row is blocked. This is called "default deny." The guidelines of the US National Institute of Standards and Technology (NIST SP 800-41) also recommend it. They say to block all traffic except what you have decided to allow. The opposite approach blocks only known dangers. Then every path that no one thought of stays open.
How it works 3: letting only replies through, with "stateful inspection"
This creates a problem. When a computer inside the company opens a website, the site sends reply packets back in from outside. With only the table, a reply goes "outside → inside," so the last row blocks it.
But writing "allow everything from outside" would give no protection. Early, simple filters did not remember the state of a connection. This approach is called simple packet filtering. With it, rules would allow traffic whose header carried a "reply" mark. That left a gap: fake replies that copied just the mark could sneak in.
So most firewalls today remember connections that were started from inside. They note, "this computer has started talking to port 443 on this server." Then they let through only the replies that match. Traffic that arrives from outside with no matching note is blocked. Because the firewall tracks the state of each connection, this is called stateful inspection. AWS officially describes its security groups as working this way, by tracking state.
NAT in a home router is a "wall by accident"
Most home routers rewrite the addresses of devices in the home into one address for the internet. This rewriting is called NAT (network address translation). The router keeps a table of connections started from inside, and sends each reply back to the right device. The "NAPT" section of "What Is an IP Address?" explains this in more detail.
Traffic that arrives from outside out of the blue is not in that table. So the router does not know which device to hand it to, and it usually never gets inside. As a result, NAT works as a wall that is a little like stateful inspection.
However, NAT was made to share scarce addresses. It was not designed as a security feature. The group that writes the internet's technical standards is called the IETF. One of its documents (RFC 4864, 2007) explains that rewriting addresses is not, in itself, a defense.
In fact, there are several holes. Say you set up "port forwarding" for a game or another app. Then traffic from outside to that port goes straight through to the device inside. Some routers also support UPnP, which lets apps ask the router to open holes automatically. And NAT puts no limits at all on traffic going out from inside.
Also, the newer address format, IPv6, has plenty of addresses, so it usually does not use NAT. So in a 2011 document (RFC 6092), the IETF recommended that home IPv6 routers include a filter that tracks state. Many home routers have a firewall function separate from NAT.
Firewalls that look inside the traffic
The firewalls so far decide by the numbers in the header. But today, many apps share the same port 443. The number alone cannot tell a business system apart from a banned file-sharing service.
So products spread that can recognize apps from features of the traffic's contents, with rules for each app. These are called "next-generation firewalls." But with encrypted traffic, they can see only a limited part of the contents. Many also build in IPS, a feature that spots and blocks traffic shaped like common attacks.
There are also firewalls made just to protect websites. They sit in front of a web server and check the contents of each incoming request. Requests that contain typical attack patterns are blocked. This is called a WAF (web application firewall). According to guidance from Japan's Information-technology Promotion Agency (IPA), a WAF reduces the impact of attacks. It does not fix the flaws in the site itself. "Firewall vs IDS vs IPS vs WAF" compares them in a table.
What a firewall can't stop
1. Dangers that come through an allowed path
If port 443 is open so people can browse the web, harmful files can arrive through it too. The same goes for harmful programs attached to emails. A firewall checks whether a path is allowed. It does not guarantee that what travels along the path is safe.
2. Tricks that get you to type things in
Some fake sites pose as real companies to make you enter your password. This trick is called phishing. Opening a fake site looks just like ordinary web traffic, so the firewall lets it through. "What Does HTTPS Mean?" explains how to spot fake sites.
3. Break-ins with the right key
Some entrances are left open on purpose so people can get in from outside, such as a company's VPN device. If attackers log in with an easy-to-guess or leaked password, the firewall can't tell them apart from real employees. "How Are Passwords Cracked?" explains how passwords get broken. "What Is a VPN?" explains why VPN devices are targeted.
4. People inside, or devices infected inside
A firewall at the boundary usually does not see traffic between devices inside. It cannot stop an insider from taking information out. Nor can it stop an attack spreading from an infected computer to other devices inside. So companies also divide their internal network into several zones. On top of that, an approach called zero trust is spreading. It checks the person and the device each time something is used.
A firewall is one layer of defense. It is used together with software updates and device monitoring. Another layer is multi-factor authentication, which checks who you are by another means besides a password.
A short history of the firewall
In the late 1980s, university and company networks were joined through the internet, and break-ins from outside became a problem. In March 1989, a lab of the US computer maker Digital Equipment Corporation (DEC) published a report. It described a way to filter packets by rules at the gateway between organizations. This is an early example of packet filtering.
Around the same time, AT&T's Bell Labs in the US also built a gateway to protect its internal network. Cheswick and Bellovin, who worked there, published a book in 1994. Titled Firewalls and Internet Security, it spread the ideas widely.
Check Point, a company in Israel, was founded in 1993. It released its product "FireWall-1" around 1993–94 (sources differ on the year). The product used stateful inspection, which remembers connections started from inside and lets replies through. On personal computers, the firewall became on by default with a major Windows XP update (SP2) in 2004.
Common myths
Myth: With a firewall, you're safe from viruses and every kind of hacking
In fact, a firewall decides which paths to open. It cannot stop harmful files on allowed paths, fake sites, or break-ins with stolen passwords. The name "firewall" suggests a wall that blocks everything, which is where this myth comes from. Use it together with antivirus software, updates and multi-factor authentication.
Myth: Turning off the firewall makes games faster
In fact, on an ordinary computer, checking traffic against the rules takes very little time. It is tiny compared with the round trip to a distant game server. Lag depends mainly on the distance to the server and how busy your line or Wi-Fi is. Games do run into trouble when incoming connections are blocked, such as for voice chat or hosting a match. Microsoft explains that turning off the firewall makes unauthorized access more likely. It advises keeping the firewall on and allowing only the apps you need.
Myth: My home router protects me, so I don't need a firewall on my computer
In fact, a home router only guards the boundary with the internet. On Wi-Fi in a café or a station, strangers' devices are connected to the same network. Even at home, if another device gets infected, attacks can come from it. In these cases, the firewall running on your computer is what protects you.
By the numbers
| Item | Figure or detail (date and source) |
|---|---|
| Range of port numbers | 0 to 65,535 (65,536 values) |
| Report on filtering packets by rules | March 1989 (DEC lab) |
| Check Point founded / FireWall-1 | 1993 / around 1993–94 |
| Cheswick and Bellovin's book | 1994 (Addison-Wesley) |
| Windows firewall on by default | 2004 (Windows XP SP2) |
| Windows default settings | Inbound: blocked except replies and allowed traffic. Outbound: allowed (as of 2026) |
| A new AWS security group | 0 inbound rules. All outbound traffic allowed (as of 2026) |
| Document saying NAT is not a security mechanism | RFC 4864 (2007, IETF) |
| Document recommending protection for home IPv6 routers | RFC 6092 (2011, IETF) |
There are 65,536 port numbers. But a home computer usually needs almost none of them open to incoming traffic from outside. That is why rules can say "open only the few you need, and close all the rest."
Learn more
- Compare defenses in a table: Firewall vs IDS vs IPS vs WAF
- Guarding the boundary, and the approach that comes next: Perimeter Security vs Zero Trust
- Try dividing a network with numbers: IP subnet calculator
- Terms for your next step: intrusion detection system (IDS) (finds and reports traffic that looks like an attack), principle of least privilege (allowing only what is needed), VLAN (dividing networks on one device)
- Related articles: "What Is a VPN?" "What Is Encryption?"