Firewalls

⏱ 7 min✏️ Quiz at the end

A Gatekeeper for Traffic

Every device connected to a network is, in principle, reachable by every other device on it — including strangers on the internet, constantly probing for anything unprotected. A firewall is the gatekeeper that stops that from being a free-for-all: software (sometimes built into hardware) that inspects network traffic and decides, connection by connection, what is allowed through and what is refused.

The name is a borrowed metaphor. Buildings have physical firewalls — walls built specifically to stop a fire in one section from spreading to the next. A network firewall does the digital equivalent: containing danger to one side of a boundary, refusing to let it cross.

Rules: What Gets Through

A firewall works from a set of rules, checked against every attempted connection. Rules typically reference:

  • Source and destination address — where the traffic claims to come from, and where it's headed (IP addresses, the postal system of networking)
  • Port — a number attached to network traffic that loosely signals what kind of service is being requested (web traffic, email, file transfer each conventionally use different ports — like different counters at a large building, each serving a different purpose)
  • Direction — traffic leaving the network versus traffic trying to enter it

A simple, common firewall stance: "allow anything this network asked for; block anything uninvited arriving from outside." That single rule quietly defeats a huge amount of casual internet-wide scanning — random attempts knocking on every door, hoping one is unlocked.

Where Firewalls Live

  • Home routers almost always include a basic firewall, silently rejecting unsolicited inbound connections from the internet — most people never see it working, because it is working by being invisible
  • Individual devices (laptops, phones) often run their own firewall software too, controlling which apps are allowed to send and receive network traffic — a second, more granular layer
  • Schools and businesses frequently run more elaborate firewalls that also enforce policy: blocking categories of website, restricting certain services, or logging attempted connections — security and organisational rules, applied at the network gate

Layering device firewalls behind network firewalls is the same instinct as 3-2-1 backups or layered malware defence: no single barrier is trusted alone.

What a Firewall Does Not Do

It is worth being precise about the boundary of a firewall's job, because misunderstanding it leads to false confidence. A firewall controls network traffic — connections arriving or leaving. It does not:

  • Stop a user from installing something harmful themselves (a trojan disguised as wanted software runs happily once double-clicked — though the firewall might catch it later, trying to "phone home" to an attacker)
  • Scan files already sitting on the device for malicious code (that is antivirus software's job)
  • Protect against a user being tricked by phishing into handing over a password directly

This is exactly why defence in depth matters: a firewall, antivirus software, careful updates, cautious clicking, and good backups each block a different route in, and together cover far more ground than any one of them alone.

Try It Yourself

For each scenario, decide whether a firewall is the right tool, and why (or why not): (1) a stranger on the internet repeatedly trying to connect to your home printer's control panel; (2) a phishing email asking you to type your password into a fake site; (3) a school wanting to block social media during lessons; (4) a virus already inside a downloaded file, waiting to be opened.

Worked Example — Writing a Small Set of Firewall Rules

Firewall rules are typically checked in order, and the first matching rule wins — a detail that matters a great deal in practice. Imagine a school network with this rule list:

Rule 1: ALLOW traffic to/from the school's own learning platform
Rule 2: BLOCK traffic to known social media domains
Rule 3: ALLOW all other outbound web traffic

Trace a request to the school's learning platform: it matches Rule 1 first, so it is allowed, and the later rules are never even checked for that request. Now trace a request to a social media site: it does not match Rule 1 (wrong destination), so the firewall moves to Rule 2 — a match — and the request is blocked, never reaching Rule 3. This "first match wins, then stop checking" behaviour is exactly like the ELSE IF chain from selection: order matters. If Rule 2 and Rule 1 were swapped, and the learning platform happened to share infrastructure with a blocked social media provider, students might find the platform itself blocked by accident — a genuine, real-world category of firewall misconfiguration bug.

Key Words

  • Firewall — software (or hardware) that inspects and filters network traffic by rule
  • Rule — a firewall's criteria for allowing or blocking a connection
  • Port — a number signalling the type of service network traffic relates to
  • Inbound / outbound traffic — connections arriving from outside / leaving toward outside
  • Defence in depth — combining several different security measures, since none is complete alone
Related Topics