What Is a Firewall and How Does It Work?

A firewall is a network security system that inspects traffic moving between networks and decides what gets through. Cisco describes it as a barrier between trusted internal networks and untrusted external ones, most commonly the internet. It enforces a list of rules defining which packets, connections, and applications are permitted, then blocks everything that fails the check. The idea dates to the late 1980s, and the firewall is still the first line of defense for nearly every network today.

What does a firewall do?

Data crossing a network travels as packets, small units whose headers carry source and destination IP addresses, port numbers, and a transport protocol. A firewall reads those headers and compares each packet against an ordered ruleset. The first matching rule decides the outcome: the packet is either forwarded or silently dropped.

Firewalls take several physical forms. A hardware appliance guards a network's perimeter, usually placed just behind the router. Software firewalls run on individual devices and filter from the inside. Cloud and virtual firewalls apply the same logic to data center and hybrid environments without any dedicated hardware.

How does a firewall work?

Rules are evaluated from top to bottom, and the first match applies. Security-conscious setups end the list with a default-deny rule that blocks anything not explicitly allowed. That's safer than default-allow, because an administrator opens only what's genuinely needed.

Modern firewalls are stateful. They maintain a state table of active connections, recording addresses, ports, and connection status. When your laptop requests a web page, the firewall logs the outbound request and automatically accepts the response that returns. An unsolicited packet arriving on the same port has no matching entry, so it's dropped. That one distinction filters out a huge share of internet background noise.

Next-generation firewalls go further. NGFWs add deep packet inspection, application identification, integrated intrusion prevention, and identity-aware policies on top of stateful filtering. A basic firewall sees traffic on port 443. An NGFW sees which application is using that port and who's behind it.

Main types of firewalls

Packet-filtering firewalls are the simplest kind. They judge each packet in isolation using header fields only, which makes them fast but blind to connection context. Spoofed packets can slip past them.

Stateful inspection firewalls added connection tracking and became the standard from the 1990s onward. Web application firewalls specialize in HTTP traffic, shielding web apps from threats like SQL injection and cross-site scripting. Next-generation firewalls combine stateful inspection with payload analysis and live threat intelligence, and most enterprise deployments now use this combined approach.

Firewall rules in practice

The fastest way to understand a firewall is to read one. On Linux, the ufw tool manages kernel packet-filtering rules with plain commands:

# Default policy: block all incoming traffic
sudo ufw default deny incoming

# Allow SSH only from the local subnet
sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp

# Allow standard web traffic
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Activate the ruleset
sudo ufw enable

Behind the scenes, these become entries in the kernel's filter table. Listing them reveals the ordered ruleset and the policy applied to anything unmatched:

$ sudo iptables -L INPUT -n --line-numbers
Chain INPUT (policy DROP)
num   pkts bytes target prot opt in  out source         destination
1     8412  612K ACCEPT tcp  --  *   *   192.168.1.0/24 0.0.0.0/0    tcp dpt:22
2     3188  402K ACCEPT tcp  --  *   *   0.0.0.0/0      0.0.0.0/0    tcp dpt:443
3      947   61K ACCEPT tcp  --  *   *   0.0.0.0/0      0.0.0.0/0    tcp dpt:80
4    20114 2.1M DROP   all  --  *   *   0.0.0.0/0      0.0.0.0/0

The (policy DROP) line is default-deny in action. Anything that fails to match the ACCEPT entries above it never reaches an application, and the packet counters on each line show exactly how much traffic each rule is catching.

What firewalls can't do

A firewall filters traffic where it crosses a boundary. It can't see inside most encrypted flows unless TLS inspection is configured, and it has no view of what happens inside the trusted zone. Malware carried in on a USB stick, or an employee misusing legitimate access, never crosses the perimeter at all.

Important: A firewall is one layer, not a complete security strategy. Pair it with endpoint protection, timely patching, and regular review of firewall logs, since blocked traffic patterns often reveal scanning or misuse before an incident.

Firewalls in the bigger networking picture

Every firewall rule depends on addressing. Rules reference IP addresses and subnet ranges, so understanding subnet masks helps you write precise rules instead of overly broad ones that block legitimate traffic.

Firewalls also overlap with neighboring technologies. A proxy server terminates and re-issues connections on a client's behalf, a different mechanism aimed at a similar goal of controlled access. Many NGFWs now include proxy functions, which blurs the line between the two.

For anyone studying network security, the firewall is the right starting point. Once rule-based filtering clicks, intrusion detection, zero-trust segmentation, and cloud security groups all build on the same core principle: allow what's needed, deny the rest by default.

Dig Trace