What Is a Firewall? Types, How They Work & Why You Need One

Last Updated: October 2026

A firewall is one of the most fundamental components of network security. Whether you are protecting a home computer, a small business network, or a global enterprise infrastructure, a firewall serves as the first line of defense against unauthorized access and malicious traffic. It monitors every packet entering and leaving your network and decides — based on a set of predefined rules — whether to allow, deny, or drop that traffic.

In this guide, we will explain how firewalls work at every level, compare the different types of firewalls, walk through firewall configuration on Windows, macOS, and Linux, cover common mistakes and best practices, and explore how firewalls interact with port forwarding. If you want to test which ports are accessible on your network right now, try our Port Checker tool.

How Firewalls Work

At the most basic level, a firewall examines network packets — small units of data traveling across a network — and compares them against a set of rules (often called an access control list or ACL). Each rule specifies conditions like source IP address, destination IP address, port number, and protocol (TCP or UDP), along with an action: allow (pass the packet through), deny/reject (block the packet and inform the sender), or drop (silently discard the packet without notification).

Rules are evaluated in order, from top to bottom. When a packet matches a rule, the specified action is taken and no further rules are evaluated for that packet. This is why rule ordering matters — placing a broad "allow all" rule at the top would override every restrictive rule below it.

Types of Firewalls

Packet Filtering Firewalls

Packet filtering is the simplest and oldest form of firewall technology. A packet filtering firewall inspects each packet's header information — source and destination IP addresses, source and destination ports, and the protocol — and compares it against a static rule set. It makes allow/deny decisions based purely on this header data without examining the packet's contents or understanding the context of the connection.

Advantages: Extremely fast and efficient because it only examines headers. Low resource usage. Simple to implement and understand.

Disadvantages: Cannot detect attacks hidden within allowed traffic. Cannot distinguish between legitimate and malicious packets that share the same header characteristics. Vulnerable to IP spoofing and fragmentation attacks. Does not understand application-layer protocols.

Stateful Inspection Firewalls

Stateful inspection (also called dynamic packet filtering) is a significant improvement over basic packet filtering. Instead of evaluating each packet in isolation, a stateful firewall maintains a state table that tracks the state of every active connection passing through it. The state table records details like source/destination IPs, ports, sequence numbers, and connection phase (SYN, SYN-ACK, ESTABLISHED, etc.).

When a new packet arrives, the firewall first checks whether it belongs to an existing, legitimate connection in the state table. If so, it is allowed through without further rule evaluation. If not, it is evaluated against the rule set as a new connection attempt. This approach is much more secure because it can detect and block packets that do not match any valid connection state — for example, an unsolicited ACK packet that is not part of any tracked connection (a common reconnaissance technique).

Nearly all modern firewalls use stateful inspection as a baseline. Windows Defender Firewall, macOS Application Firewall, and Linux's iptables/nftables all perform stateful inspection by default.

Application-Layer Firewalls (Layer 7)

Application-layer firewalls (also called proxy firewalls or Layer 7 firewalls) operate at the top of the OSI model and can inspect the contents of packets, not just headers. They understand application protocols like HTTP, FTP, DNS, and SMTP, allowing them to make filtering decisions based on the actual data being transmitted.

For example, an application-layer firewall can block specific URLs, detect SQL injection attempts in HTTP POST requests, filter email attachments by file type, or block DNS queries for known malicious domains. Web Application Firewalls (WAFs) like Cloudflare WAF, AWS WAF, and ModSecurity are specialized application-layer firewalls designed to protect web applications from attacks like cross-site scripting (XSS), SQL injection, and remote file inclusion.

Next-Generation Firewalls (NGFW)

Next-generation firewalls combine traditional stateful inspection with a suite of advanced security capabilities in a single device or platform. An NGFW typically includes:

• Deep Packet Inspection (DPI): Analyzes the full content of packets, not just headers, to detect malware, exploits, and policy violations.
• Intrusion Prevention System (IPS): Detects and blocks known attack patterns and exploit signatures in real time.
• Application Awareness: Identifies and controls applications regardless of port or protocol. For example, an NGFW can distinguish between Skype, BitTorrent, and regular HTTPS traffic even if all three use port 443.
• SSL/TLS Inspection: Decrypts encrypted traffic, inspects the contents for threats, and re-encrypts it before forwarding. This is essential because over 90% of web traffic is now encrypted.
• Threat Intelligence: Integrates with real-time threat feeds to block connections to known malicious IPs, domains, and URLs.
• User Identity Awareness: Ties firewall policies to specific users or groups (via Active Directory or LDAP integration), not just IP addresses.

Leading NGFW vendors include Palo Alto Networks, Fortinet (FortiGate), Cisco (Firepower), Check Point, and Sophos. NGFWs are the standard for enterprise network security.

Hardware vs. Software Firewalls

Hardware Firewalls

A hardware firewall is a dedicated physical device that sits between your network and the internet (typically between your modem and your LAN). It filters traffic for every device on the network. Most home and small business routers include a built-in hardware firewall with NAT (Network Address Translation), which provides basic protection by hiding internal IP addresses behind a single public IP.

Enterprise hardware firewalls (like Palo Alto PA-series or Fortinet FortiGate) are purpose-built appliances with dedicated processors for deep packet inspection, high throughput, and centralized management of complex rule sets across multiple network segments.

Software Firewalls

A software firewall is a program that runs on an individual computer or server and filters traffic for that specific device. Every major operating system ships with a built-in software firewall:

• Windows Defender Firewall (formerly Windows Firewall) — enabled by default on all Windows installations.
• macOS Application Firewall — controls incoming connections on a per-application basis.
• Linux iptables/nftables/ufw — powerful command-line firewall tools built into the Linux kernel.

Software firewalls are essential for defense in depth — even behind a hardware firewall, individual devices should have their own software firewall to protect against threats that originate inside the network (e.g., a compromised IoT device or a malware-infected laptop on the same LAN).

Configuring Firewalls by Operating System

Windows Defender Firewall

Windows Defender Firewall is enabled by default and uses separate rule profiles for Domain (corporate network), Private (home/trusted network), and Public (untrusted Wi-Fi) networks. You can manage it through:

• Windows Security app: Settings > Privacy & security > Windows Security > Firewall & network protection. Provides a simple on/off toggle and basic allow/block per profile.
• Windows Defender Firewall with Advanced Security (wf.msc): The full management console for creating detailed inbound and outbound rules by port, program, protocol, IP range, and profile.
• Command line (netsh): Use netsh advfirewall for scripted rule management. Example: netsh advfirewall firewall add rule name="Allow HTTP" dir=in action=allow protocol=tcp localport=80.
• PowerShell: Use New-NetFirewallRule for modern scripted management. Example: New-NetFirewallRule -DisplayName "Allow SSH" -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow.

macOS Firewall

macOS includes two firewall mechanisms. The Application Firewall (System Settings > Network > Firewall) controls incoming connections on a per-application basis — you can allow or block specific apps from receiving inbound connections. For more granular control, macOS also includes PF (Packet Filter), a powerful BSD-based firewall that can be configured via /etc/pf.conf. PF supports packet filtering, NAT, and traffic shaping, but requires command-line expertise.

Linux Firewalls: iptables, nftables, and ufw

Linux provides the most powerful and flexible firewall tools, all built around the Netfilter framework in the kernel:

• iptables: The classic Linux firewall tool. Rules are organized into chains (INPUT, OUTPUT, FORWARD) within tables (filter, nat, mangle). Example: sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT allows inbound SSH.
• nftables: The modern replacement for iptables, offering cleaner syntax, better performance, and a unified framework for IPv4/IPv6. Example: sudo nft add rule inet filter input tcp dport 22 accept.
• ufw (Uncomplicated Firewall): A user-friendly front-end for iptables, popular on Ubuntu and Debian. Example: sudo ufw allow 22/tcp allows SSH, and sudo ufw enable activates the firewall.
• firewalld: A zone-based firewall manager used by Red Hat, CentOS, and Fedora. It uses zones (public, home, internal, etc.) to apply different rule sets based on network trust level.

Router Firewalls

Most home routers include a basic SPI (Stateful Packet Inspection) firewall combined with NAT. NAT itself provides a layer of protection by hiding internal devices behind a single public IP — unsolicited inbound connections have nowhere to go unless port forwarding is configured. Router firewall settings are typically accessed through the router's web interface (e.g., 192.168.1.1) and may include options to enable or disable SPI, configure port forwarding, set up a DMZ (demilitarized zone), and block specific IPs or services.

Firewall Rules: Best Practices

Default Deny (Whitelist Approach)

The most secure firewall philosophy is default deny — block all traffic by default and only allow specific, known-good traffic through explicit rules. This is the opposite of a "default allow" (blacklist) approach, which allows everything unless specifically blocked. Default deny ensures that any new, unexpected, or malicious traffic is blocked automatically.

Inbound vs. Outbound Rules

Inbound rules control traffic arriving at your network or device. These should be strictly configured to only allow traffic on ports and protocols that your services require. For example, a web server should have inbound rules allowing TCP ports 80 and 443, but nothing else from the internet.

Outbound rules control traffic leaving your network or device. While many firewalls default to allowing all outbound traffic, restricting outbound connections can prevent malware from "phoning home" to command-and-control servers, stop data exfiltration, and limit the blast radius of a compromised device.

Port-Based Filtering

Port-based filtering is the most common rule type. You specify which TCP and UDP ports to allow or block. Key considerations:

• Only open ports for services you are actively running. An open port with no listening service is still a potential attack vector.
• Use specific port numbers rather than port ranges whenever possible.
• Remember that both TCP and UDP use the same port number space independently — allowing TCP port 53 (DNS) does not automatically allow UDP port 53.
• Use our Port Checker to verify which ports are externally accessible after configuring your rules.

Source and Destination IP Filtering

Restrict rules by IP address whenever possible. For example, if your SSH server should only be accessible from your office IP, create a rule that allows TCP port 22 only from your office's IP address rather than from any source. This dramatically reduces the attack surface.

Rule Ordering

Firewalls evaluate rules from top to bottom and stop at the first match. Place more specific rules (e.g., allow SSH from 203.0.113.10) before broader rules (e.g., deny all inbound). A misplaced broad rule can inadvertently override specific rules and create security gaps.

Common Firewall Mistakes

• Leaving default rules unchanged: Many firewalls ship with permissive default rules. Always review and tighten the default configuration.
• Opening too many ports: Each open port is a potential entry point. Only open ports that are actively needed.
• Using "Allow All" as a troubleshooting shortcut: When a service is not working, disabling the firewall to test might diagnose the issue, but forgetting to re-enable it leaves the system permanently exposed.
• Not logging or monitoring: Enable firewall logging to detect reconnaissance attempts, brute-force attacks, and misconfigured rules. Review logs regularly.
• Ignoring outbound rules: Most home and many enterprise firewalls allow all outbound traffic by default. Implementing outbound restrictions can catch malware communication and data exfiltration.
• Forgetting IPv6: If your network supports IPv6, ensure your firewall rules cover IPv6 traffic as well. Many administrators configure IPv4 rules meticulously but leave IPv6 wide open.
• Not testing after changes: Always verify firewall changes with actual connection tests. Use our Port Checker or nmap to confirm ports are open or closed as expected.

Firewalls and Port Forwarding

Port forwarding and firewalls interact closely, and misunderstanding this interaction is one of the most common causes of "port forwarding not working" issues. For a deeper dive, see our How to Check Open Ports guide.

When you set up port forwarding on your router, you are telling the router to redirect incoming traffic on a specific external port to an internal device and port. However, this only gets the traffic to the device — the device's own software firewall must also allow inbound connections on that port. A common mistake is configuring port forwarding on the router but forgetting to create an inbound allow rule on the device's software firewall.

The correct order to verify when port forwarding is not working:

1. Confirm the service is running and listening on the expected port (use netstat -an or ss -tlnp).
2. Confirm the device's software firewall allows inbound traffic on that port.
3. Confirm the router's port forwarding rule is correctly configured (correct external port, internal IP, and internal port).
4. Confirm the router's own firewall (SPI) is not blocking the forwarded traffic.
5. Test from an external network (not from inside the same LAN) using our Port Checker.

Firewalls in Cloud and Enterprise Environments

In cloud environments (AWS, Azure, GCP), firewalls operate differently than traditional on-premises setups but serve the same purpose:

• Security Groups (AWS/Azure): Virtual firewalls that control inbound and outbound traffic for cloud instances. They are stateful — if you allow an inbound rule, the return traffic is automatically allowed.
• Network ACLs (AWS): Subnet-level firewalls that operate at the VPC (Virtual Private Cloud) level. They are stateless, meaning you must explicitly allow both inbound and outbound traffic.
• Cloud WAFs: Services like AWS WAF, Azure Front Door, and Cloudflare WAF protect web applications from application-layer attacks.
• Microsegmentation: Advanced strategy that applies firewall rules between individual workloads (not just at the network perimeter), limiting lateral movement of attackers who breach the outer firewall.

Firewall vs. Other Security Tools

Firewalls are one piece of a comprehensive security strategy. Here is how they compare to and complement other tools:

• Firewall vs. Antivirus: Firewalls filter network traffic; antivirus scans files and processes for malware. Both are needed — a firewall blocks unauthorized connections, while antivirus catches malware that arrives through allowed channels (email attachments, downloads).
• Firewall vs. IDS/IPS: An Intrusion Detection System (IDS) monitors traffic for suspicious patterns and alerts administrators. An Intrusion Prevention System (IPS) does the same but can also block the traffic. NGFWs typically include IPS built-in.
• Firewall vs. VPN: A VPN encrypts your traffic and masks your IP address. A firewall controls which traffic is allowed in and out of your network. They serve different purposes and are complementary — you might use a VPN for remote access and a firewall to protect the network the VPN connects to.

Frequently Asked Questions

What is a firewall in simple terms?

A firewall is a security system that monitors and controls network traffic based on predefined rules. It acts as a barrier between your trusted network and the untrusted internet, blocking unauthorized access while permitting legitimate communication.

What is the difference between hardware and software firewalls?

A hardware firewall is a dedicated device (or router firmware) that protects all devices on a network at the perimeter. A software firewall is a program on an individual computer that protects only that machine. Use both for defense in depth — the hardware firewall protects the network, while software firewalls protect individual devices from internal threats.

What is stateful inspection?

Stateful inspection tracks the state of active connections. Instead of evaluating each packet in isolation, the firewall remembers whether a connection was legitimately initiated and only allows response packets that belong to established connections. This is the standard for all modern firewalls.

What is a next-generation firewall (NGFW)?

An NGFW combines traditional firewall capabilities with advanced features like deep packet inspection, intrusion prevention (IPS), application-level awareness, SSL/TLS traffic inspection, and real-time threat intelligence. NGFWs can control traffic based on the application, not just the port or protocol.

What is the difference between inbound and outbound firewall rules?

Inbound rules control traffic coming into your network from external sources (e.g., internet users connecting to your web server). Outbound rules control traffic leaving your network (e.g., an app on your PC connecting to an external server). Most firewalls are more restrictive on inbound and more permissive on outbound traffic.

How do I check if my firewall is blocking a port?

Use our Port Checker tool to test whether a port is reachable from the internet. On Windows, run netsh advfirewall firewall show rule name=all or check Windows Defender Firewall settings. On Linux, use sudo iptables -L -n or sudo ufw status. If the service is running locally but the port is closed externally, the firewall is likely blocking it.

What is the difference between DROP and REJECT in firewall rules?

DROP silently discards the packet — the sender gets no response and the connection eventually times out. REJECT sends an explicit error message back to the sender. DROP is preferred for internet-facing firewalls (gives attackers less information), while REJECT is useful on internal networks for faster troubleshooting.

Does a firewall protect against all cyber threats?

No. Firewalls control network traffic but cannot protect against threats that bypass the network boundary, such as USB-delivered malware, phishing emails, or vulnerabilities in applications receiving allowed traffic. Firewalls are one essential layer in a defense-in-depth strategy that includes antivirus, patching, user training, and intrusion detection.