What Is a Firewall? How Network Traffic Gets Filtered

Computers constantly send and receive packets of data. Those packets contain information such as source and destination addresses, protocol details, and port numbers. A firewall can examine some of this information and compare it with configured security rules before deciding whether the traffic should continue.

This filtering is the basic answer to what a firewall is. For example, a rule might allow ordinary web traffic while blocking an unexpected connection to a sensitive service. The exact decision depends on the firewall, its configuration, and how deeply it examines the traffic. A firewall is therefore a rule-based gatekeeper rather than a magical wall around a computer.

Simple packet-filtering firewalls make decisions using information in packet headers. Stateful firewalls can also remember the state of active connections, helping them distinguish traffic that belongs to an established session from unrelated incoming packets. More advanced systems may inspect application-level information or combine firewall functions with other security tools.

There are also hardware and software forms. A home router may include firewall features that help separate a local network from the wider internet. An operating system can run a software firewall directly on a laptop or desktop. When learning about firewalls, remember that several firewalls can exist at different points between an application and the internet.

A firewall can reduce exposure by blocking connections that should not be allowed, but it cannot prevent every possible security problem. If harmful data travels through an allowed connection, a basic firewall may not recognise it. A user can also install malicious software, reuse a stolen password, or be tricked into giving away information.

That is why a firewall should be understood as one layer of cybersecurity. Secure updates, strong authentication, careful software choices, backups, encryption, and sensible permissions also matter. Good firewall rules reduce unnecessary access while still allowing legitimate traffic to reach the services that need it. A badly configured firewall can either block useful work or leave too much open.

A rule is usually a small table: direction, source, destination, protocol, port and action. 'Inbound, from any address, to this server, TCP, port 443, allow' lets the world reach a website over HTTPS. 'Inbound, from any, to any, TCP, port 22, deny' stops outsiders reaching the remote login service. Rules are checked in order and the first match wins, so most firewalls end with a rule that denies everything not already allowed.

That final default-deny line is the whole philosophy in one row: nothing gets in unless someone decided it should. Outbound rules are less common on home devices but matter in businesses, where they stop an infected machine from quietly contacting an attacker. If you have ever been asked to 'open a port' for a game or a video call, you were being asked to add an allow rule for it.

The word was borrowed from buildings. A firewall in construction is a fire-resistant wall that divides a structure so a blaze in one part cannot easily spread to the next, and cars have a similar barrier between the engine and the passengers. Engineers in the early internet era adopted the term for systems that separated a trusted internal network from the outside world. The first packet-filtering designs appeared in the late 1980s, as networks that had grown up among universities and research labs connected to people they did not know and could not trust.

Many homes now have firewall-like protection without anyone setting it up. A typical home router uses network address translation, which lets every device in the house share one public internet address. Because the router only knows where to send incoming traffic that answers a request made from inside, unsolicited connections from the internet usually have nowhere to go and are dropped. This is not a full firewall policy, and it does not stop dangerous content arriving through a connection you started, but it explains why a home network is less exposed than a computer plugged straight into the internet.

Imagine your laptop opening a secure website. It sends a first packet from its own address and a temporary port, say 51514, to the server's address on port 443. A stateful firewall checks its rules, finds that outgoing web traffic is allowed, and records the connection in a state table: the two addresses, the two port numbers and the protocol. When the server replies, its packets arrive from port 443 addressed to port 51514. The firewall finds the matching entry and lets them through, without needing a separate rule that permits inbound traffic from that particular server.

Now suppose a packet arrives from an unknown machine aimed at your laptop, with no matching entry. Nothing inside asked for it, so the firewall drops it. Entries do not last forever. When a connection closes normally it is removed, and when it sits idle for too long it times out, which frees memory but explains why a quiet remote session sometimes drops without warning. Many programs send small keepalive packets to prevent this. The state table also defeats a classic trick in which an attacker forges a packet that pretends to be a reply to a conversation that never took place.

A firewall that refuses traffic can do it in two ways. It can drop the packet, discarding it silently so the sender hears nothing and eventually gives up when its own timer runs out. Or it can reject the packet, sending back a refusal: for a TCP connection this is usually a reset packet, and for other traffic often an ICMP message saying the destination is unreachable. Both stop the connection, but they feel very different to the program on the other end, which either fails at once or hangs while it waits.

Administrators often reject traffic inside their own network, where a quick failure saves colleagues from waiting, and drop it at the edge facing the internet, where silence gives strangers less to work with. Port-scanning tools such as Nmap, used by both defenders and attackers, read these responses directly. A port that answers is reported as open, a port that replies with a reset is closed because nothing is listening, and a port that produces no reply at all is labelled filtered, a strong hint that a firewall is quietly dropping packets on the way.

A firewall is a network security system that checks traffic against rules and allows or blocks connections. Firewalls can operate on individual devices or across networks, and different types inspect traffic in different ways. They are valuable security layers, but they work best alongside other protective measures.