What Is a Firewall? How Network Traffic Gets Filtered
By the BrainSnail editorial team. How these articles are written and checked, and how to tell us when one is wrong.
A firewall is a security system that monitors network traffic and decides which connections should be allowed or blocked according to a set of rules. It can protect one device, a private network, or part of a larger computing system.
What a firewall does with traffic
Computers constantly send and receive packets of data. Those packets contain information such as source and destination addresses, protocol details, and port numbers. A firewall can examine some of this information and compare it with configured security rules before deciding whether the traffic should continue.
This filtering is the basic answer to what a firewall is. For example, a rule might allow ordinary web traffic while blocking an unexpected connection to a sensitive service. The exact decision depends on the firewall, its configuration, and how deeply it examines the traffic. A firewall is therefore a rule-based gatekeeper rather than a magical wall around a computer.
Firewalls can work at different levels
Simple packet-filtering firewalls make decisions using information in packet headers. Stateful firewalls can also remember the state of active connections, helping them distinguish traffic that belongs to an established session from unrelated incoming packets. More advanced systems may inspect application-level information or combine firewall functions with other security tools.
There are also hardware and software forms. A home router may include firewall features that help separate a local network from the wider internet. An operating system can run a software firewall directly on a laptop or desktop. When learning about firewalls, remember that several firewalls can exist at different points between an application and the internet.
A firewall is useful, but it is not complete security
A firewall can reduce exposure by blocking connections that should not be allowed, but it cannot prevent every possible security problem. If harmful data travels through an allowed connection, a basic firewall may not recognise it. A user can also install malicious software, reuse a stolen password, or be tricked into giving away information.
That is why a firewall should be understood as one layer of cybersecurity. Secure updates, strong authentication, careful software choices, backups, encryption, and sensible permissions also matter. Good firewall rules reduce unnecessary access while still allowing legitimate traffic to reach the services that need it. A badly configured firewall can either block useful work or leave too much open.
Reading a firewall rule
A rule is usually a small table: direction, source, destination, protocol, port and action. 'Inbound, from any address, to this server, TCP, port 443, allow' lets the world reach a website over HTTPS. 'Inbound, from any, to any, TCP, port 22, deny' stops outsiders reaching the remote login service. Rules are checked in order and the first match wins, so most firewalls end with a rule that denies everything not already allowed.
That final default-deny line is the whole philosophy in one row: nothing gets in unless someone decided it should. Outbound rules are less common on home devices but matter in businesses, where they stop an infected machine from quietly contacting an attacker. If you have ever been asked to 'open a port' for a game or a video call, you were being asked to add an allow rule for it.
The takeaway
A firewall is a network security system that checks traffic against rules and allows or blocks connections. Firewalls can operate on individual devices or across networks, and different types inspect traffic in different ways. They are valuable security layers, but they work best alongside other protective measures.