A firewall is a security system — either hardware, software, or both — that monitors incoming and outgoing network traffic and decides whether to allow or block each connection based on a set of rules. It sits between a trusted private network and an untrusted external network such as the internet, acting as a gatekeeper.
What is the analogy for a firewall?
Think of the entrance to a large building with a security guard. Every visitor must show ID and state their business. The guard has a rulebook: allow employees, allow pre-approved guests, block anyone without identification or on the banned list. Suspicious visitors are turned away before they set foot inside. A firewall plays exactly this role at the boundary of a network — checking every packet of data rather than every person, and applying rules rather than gut instinct.
What information does a firewall use to make decisions?
A firewall inspects the header of each network packet — the label attached to a parcel of data before it travels across a network:
| Header field | What it contains | Firewall use |
|---|---|---|
| Source IP address | Where the packet came from | Block traffic from suspicious or banned IP ranges |
| Destination IP address | Where the packet is going | Prevent internal devices connecting to blacklisted sites |
| Source port | Which application sent the data | Identify the originating service |
| Destination port | Which application should receive it | Block unused ports (e.g. allow port 443/HTTPS, block port 23/Telnet) |
| Protocol | TCP, UDP, ICMP, etc. | Block protocols not needed on the network |
What are the main types of firewall?
| Type | How it works | Strength | Limitation |
|---|---|---|---|
| Packet filtering | Checks each packet's header against rules; allows or blocks without context | Fast, low overhead | Cannot detect attacks spread across multiple packets |
| Stateful inspection | Tracks the state of connections; knows whether a packet is part of an established, approved session | Better at detecting malformed or out-of-sequence attacks | Slower than pure packet filtering |
| Application-level gateway (proxy) | Acts as an intermediary; inspects data at the application layer (e.g. HTTP content) | Can inspect content, not just headers | Performance overhead; requires a proxy per application |
| Next-generation firewall (NGFW) | Combines stateful inspection with deep packet inspection, intrusion detection, and application awareness | Comprehensive protection | Complex to configure, expensive |
At KS3, you are expected to understand packet filtering and stateful inspection in principle.
What are firewall rules and how do they work?
Firewall rules are ordered conditions. The firewall checks each incoming or outgoing packet against rules from top to bottom and applies the first rule that matches.
Example rule table:
| Rule | Action | Protocol | Source IP | Destination Port |
|---|---|---|---|---|
| 1 | ALLOW | TCP | any | 443 (HTTPS) |
| 2 | ALLOW | TCP | any | 80 (HTTP) |
| 3 | ALLOW | TCP | 192.168.1.0/24 | 22 (SSH) — internal only |
| 4 | BLOCK | any | any | 23 (Telnet) |
| 5 | BLOCK | any | 185.220.0.0/16 | any |
| 6 | BLOCK | any | any | any (default deny) |
The final rule — default deny — is critical: any traffic not explicitly allowed is blocked. This is the principle of least privilege applied to networking.
What is the difference between a hardware and a software firewall?
| Feature | Hardware firewall | Software firewall |
|---|---|---|
| Form factor | Physical device (router, dedicated appliance) | Program running on a computer or server |
| Protects | All devices on the network | Only the device it is installed on |
| Typical location | Network boundary (between router and internet) | Individual PCs, servers |
| Example | School/office router with built-in firewall | Windows Defender Firewall, macOS Firewall |
| Cost | Higher (hardware + management) | Low (many free options) |
Most organisations use both: a hardware firewall protects the entire network perimeter, while software firewalls on individual machines provide a second layer of defence if malicious traffic somehow gets through.
What can a firewall not do?
A firewall is powerful but not a complete security solution:
- It cannot scan encrypted content inside HTTPS for malware (without additional tools).
- It cannot prevent attacks that come through allowed ports (e.g. a virus delivered as an email attachment via port 443).
- It cannot protect against insider threats — a malicious employee is already inside the perimeter.
- It cannot stop social engineering (phishing) — users are tricked, not the firewall.
This is why firewalls are one layer in a defence in depth strategy that also includes antivirus software, encryption, strong passwords, 2FA, and staff training.
Frequently asked questions
Does every home router have a firewall?
Most modern home routers include a basic built-in firewall that performs Network Address Translation (NAT) — hiding internal IP addresses from the internet — and basic packet filtering. This provides meaningful protection by default, though it is less configurable than a business-grade hardware firewall. Windows and macOS also enable a software firewall by default, providing a second layer even on home networks.
What is a DMZ in networking?
A DMZ (Demilitarised Zone) is a network segment that sits between the internet and the private internal network, protected by firewalls on both sides. Servers that need to be publicly accessible (web servers, email servers) are placed in the DMZ. If they are compromised, the attacker is still blocked from the private internal network by the inner firewall. It is named by analogy with the demilitarised buffer zones between countries.
Can a firewall block viruses?
A basic firewall does not inspect the contents of allowed traffic for malware — it only checks headers. A firewall blocking port 25 (email relay) prevents certain spam routes, but an email delivered through an allowed port can still carry a virus. Antivirus/anti-malware software is needed to scan file contents. Some next-generation firewalls include malware detection, but even these can miss sophisticated threats.
Why do firewalls use a "default deny" rule?
Default deny (also called "deny all, permit by exception") means anything not explicitly allowed is automatically blocked. This is far safer than default allow (allowing everything not explicitly blocked), because new protocols, ports, and services are blocked automatically until deliberately opened. With default allow, any new attack vector is implicitly permitted until someone notices and adds a rule — often too late.
Understand firewalls and network security deeply with Professor Turing's guided questions at aitutors.me.