PlayInfoBox

Home /Network /What a Firewall Actually Does: The Basics

What a Firewall Actually Does: The Basics

A firewall is often described simply as "network security," but understanding what it actually checks β€” and what it does not β€” makes the concept much clearer.

The most basic type filters traffic by packet header

A packet-filtering firewall inspects each packet's header information β€” source and destination IP address, port number, and protocol β€” against a set of rules, and allows or blocks it without looking at the traffic's broader context.

Stateful firewalls track ongoing connections

A stateful firewall remembers the state of active connections, so it can automatically allow legitimate return traffic for a connection you initiated, while still blocking unsolicited traffic that was not part of any recognized session β€” a meaningful improvement over stateless packet filtering.

Next-generation firewalls (NGFW) inspect deeper

An NGFW adds capabilities beyond traditional filtering, such as inspecting the actual application and content of traffic, integrated intrusion prevention, and identifying specific applications generating traffic rather than just ports and protocols.

Inbound and outbound rules serve different purposes

Inbound rules control what is allowed to reach your network or device from outside, which is the primary line of defense against external attacks. Outbound rules control what your own device or network is allowed to send out, which can catch malware trying to communicate with an external server.

"Default deny" is the safer baseline configuration

A well-configured firewall typically blocks everything by default and only opens the specific ports and connections that are actually needed, rather than allowing everything and trying to block known bad traffic after the fact.

A firewall cannot stop every kind of threat

A firewall generally cannot protect against attacks that occur over traffic it is configured to allow β€” such as a malicious email attachment opened by a user, a compromised legitimate website, or credentials stolen through phishing β€” since none of that traffic looks abnormal at the network level.

Why "firewall" alone is not a full security strategy

A firewall controls what traffic is allowed to cross a network boundary, but it has no visibility into what happens after legitimate-looking traffic is let through β€” a user clicking a malicious link inside an allowed web connection is invisible to a firewall's rule set. This is why firewalls are typically paired with antivirus software, regular updates, and user awareness rather than relied on alone.

Home routers already include a basic firewall

Most consumer routers run a built-in stateful firewall by default, using NAT as a side effect to make devices on the home network harder to reach directly from the internet, even without the owner configuring anything manually.

Frequently Asked Questions

Do I need a separate firewall if my router already has one?

For most home users, the router's built-in firewall combined with your operating system's software firewall (like Windows Defender Firewall) provides reasonable baseline protection. Dedicated hardware firewalls are more relevant for businesses with more complex network needs.

Can a firewall slow down my internet connection?

A properly configured firewall on modern hardware has minimal impact on typical home internet speeds. Deep packet inspection features on NGFWs can add some processing overhead, which matters more at business scale than for typical home traffic.