What Is a Firewall? How Your Devices Filter Traffic

A firewall is a bouncer for network traffic: it examines connections against a rule list and decides — allow or block. You're almost certainly running two right now without thinking about them: one in your router, one in your operating system. Understanding what they actually do turns "mysterious network problem" into "oh, the firewall."

How firewalls decide

Rules evaluate packet properties: source and destination IP address, port, protocol, and — critically — connection state. Modern firewalls are stateful: they remember which connections you initiated and automatically allow the replies, while unsolicited inbound attempts match no known connection and get dropped. That asymmetry — outbound free, inbound blocked-by-default — is the core posture protecting every home network.

The firewalls you already have

• Your router — a stateful firewall working alongside NAT (which independently blocks unsolicited inbound traffic simply by having nowhere to send it). Together they make your network invisible to casual port scans. Port forwarding rules are deliberate exceptions punched through both.
• Your OS — Windows Defender Firewall and macOS's application firewall filter per-program, which matters on networks your router doesn't guard: café Wi-Fi, hotels, airports. This is why Windows asks "Home or Public?" — Public applies the strict profile. See public Wi-Fi safety.
• Servers and clouds — security groups and host firewalls doing the same job for exposed machines, where default-deny discipline is the difference between quiet logs and a breach.

What firewalls don't do

A firewall filters connections, not content or behaviour. It won't stop phishing, malware you download voluntarily, credential theft, or anything riding inside connections you initiated — a malicious page arrives over the same allowed HTTPS as a legitimate one. That's why firewalls are one layer among several: updates, sane exposure (minimal forwards), strong authentication, and encryption each cover what the others miss.

Practical firewall hygiene

1. Leave the defaults on — don't disable a firewall to "fix" an app; add a specific rule instead.
2. Audit exceptions occasionally — programs you allowed years ago keep their permissions.
3. Choose "Public" on untrusted networks — the whole point of the profile system.
4. When something can't connect, check firewalls at both ends before blaming the network — a blocked inbound port on the destination looks identical to an outage. Ping and traceroute help locate which layer is dropping you.

Frequently asked questions