Definition and purpose
A firewall is a security system that filters incoming and outgoing network traffic based on an established set of rules. Its main purpose is to reduce the risk of unauthorized access by deciding which connections are allowed and which are blocked.
A simple model of how it works
In a basic view, a firewall sits between networks (or between parts of the same network) and checks traffic as it tries to connect. When a connection request is made, the firewall evaluates details such as source and destination addresses, ports, and the traffic type. Depending on the rules, it then permits the traffic, blocks it, or applies additional scrutiny.
Many firewall approaches differ in how deeply they inspect traffic, but the decision process is still rule-based. In other words, the firewall helps enforce a “defined set of allowed behaviors” rather than trying to make security decisions on its own.
What parts it can cover
Firewalls can be deployed in different locations, for example:
- On an individual device (software firewall) to control local inbound and outbound traffic.
- On a network gateway (hardware or managed firewall) to control traffic between networks.
- As an embedded function in network infrastructure that enforces centrally managed rules.
Because deployment varies, what the firewall can protect against also varies. A firewall can limit which network connections can be established, but it generally cannot remove threats that occur without network access or that originate from already-authorized activity.
Differences and practical limits
A useful distinction is between firewalls that mainly filter by connection details (often simpler rules) and those that also perform deeper inspection (more context, but still rule- and configuration-dependent). Regardless of type, common limitations include:
- Misconfiguration: a firewall that allows more than necessary can provide a false sense of safety.
- Incomplete visibility: traffic that bypasses the firewall or uses unexpected paths may not be filtered.
- Non-network threats: malware delivered after a legitimate connection, or vulnerabilities inside permitted services, may still require additional controls.
A key exception to keep in mind is that a firewall is not a complete security solution by itself. It is one protective layer for network access control, and its effectiveness depends on correct rules and an accurate understanding of what should be allowed.
How to use this knowledge to check a setup
If you want to reason about firewall coverage in plain terms, ask:
- Where is the firewall deployed (device, gateway, or both)?
- What traffic is allowed or blocked by the current rules (which ports and destinations)?
- Are there routes or services that can reach the system without passing through the expected firewall control?
- Do existing services require stricter limits than “default allow,” especially for remote access?
Main takeaway
A firewall is a rules-based traffic filter that helps prevent unauthorized network connections. It improves safety when configured carefully, but it cannot compensate for every other security weakness or threat that does not involve blocked network access.