What is a Firewall? Types, How It Works, and Configuration Basics

A firewall is the guard at the door of your network. It watches every piece of traffic going in or out and, using a list of rules, decides what to let through and what to block – by where it came from, where it is going, and which numbered “door” (port) it wants to use. This guide explains, in plain terms, what a firewall does, the difference between hardware and software firewalls, inbound versus outbound, the main types, and the firewall you almost certainly already have running.

What Is a Firewall?

A firewall is a security checkpoint that sits between a trusted network and an untrusted one (like the internet) and inspects every packet trying to cross:

• What it does: based on your rules, it permits, blocks, or logs each packet or connection.
• Where the name comes from: a firewall in a building is a fire-resistant barrier that stops a fire spreading – a network firewall contains threats inside defined zones the same way.
• Why it matters: it is the front line that keeps unwanted visitors out and limits where a threat can go if it gets in.

The first network firewalls were built in 1988 by engineers at Digital Equipment Corporation (DEC), and the first paper on firewall technology was published by researchers at AT&T Bell Labs the same year. The first commercial product, DEC SEAL, shipped in 1992.

How Does a Firewall Work?

A firewall works by checking every packet against an ordered list of rules and acting on the first rule that matches. Think of ports as numbered doors and the rules as the guard’s instructions for each one:

• A packet arrives. The firewall reads its source IP, destination IP, source port, destination port, and protocol (TCP, UDP, or ICMP).
• Rules are checked top to bottom. The list is scanned in order until the packet matches a rule.
• The first match wins. That rule’s action runs: allow, deny, drop, or log. No later rule is considered.
• Anything unmatched is denied. A default-deny rule at the bottom blocks traffic you never explicitly allowed – the fail-safe default.

Inbound vs Outbound: The Two Directions a Firewall Controls

A firewall has rules for two directions – traffic coming in (inbound) and traffic going out (outbound), and they protect against different things:

• Inbound rules govern traffic arriving from outside. They block unsolicited connection attempts, known-bad sources, port scans, and attacks like malware probes and DDoS before they reach your devices.
• Outbound rules govern traffic leaving your network – web browsing, app updates, email. They can stop malware from “calling home” to an attacker, limit data being smuggled out, and keep users off risky destinations.
• Default behavior: most home and OS firewalls block unrequested inbound by default but allow outbound, so the internet works normally while strangers cannot reach in.

What Are the 4 Types of Firewalls?

Firewall technology grew through four generations, each one inspecting traffic more deeply than the last:

Each generation builds on the one before it. The table near the end of this guide lines all four up side by side.

How a Packet Filtering Firewall Works

A packet filtering firewall inspects each packet in isolation, looking only at the header, and keeps no memory between packets:

• Looks at: source IP, destination IP, source port, destination port, and protocol – nothing inside the payload.
• Strength: the fastest type, since it does minimal work per packet (OSI Layer 3 and 4).
• Weakness: it cannot tell whether a packet is a reply to something you requested or a new unsolicited attempt, so spoofed-source packets can slip through.

How a Stateful Inspection Firewall Works

A stateful inspection firewall tracks every active connection in a state table and checks new packets against it first:

• Tracks sessions: for TCP it follows the 3-way handshake (SYN, SYN-ACK, ACK) to confirm a connection is real.
• Smart replies: return traffic from a connection you started is allowed automatically, with no separate inbound rule needed.
• Everywhere: it is the baseline type in Windows Defender Firewall, Linux (nftables/iptables), macOS, and enterprise hardware.

How an Application Layer (Proxy) Firewall Works

An application layer (proxy) firewall inspects the actual application data inside packets, not just the headers:

• Understands protocols: HTTP, HTTPS, FTP, DNS, SMTP – so it can read URLs, headers, and request methods.
• Can enforce detail: block specific URLs, catch SQL injection in parameters, allow only GET/POST, or validate DNS replies. It proxies the connection and sees the full stream.
• Trade-off: it adds noticeable latency and only handles protocols its engine already supports.

How a Next-Generation Firewall (NGFW) Works

A next-generation firewall combines stateful inspection with deep packet inspection and several security engines in one box:

• Adds: deep packet inspection (DPI), built-in intrusion prevention (IPS), application awareness (identifying an app regardless of port), SSL/TLS inspection, user-identity rules, and threat-intelligence feeds.
• Real examples: it can spot a Tor connection hiding on port 443, allow LinkedIn but block its messaging, or block known botnet command-and-control IP ranges.
• Market: the enterprise standard – the global NGFW market was about $4.7 billion in 2023, projected near $10.2 billion by 2028 (MarketsandMarkets). Products include Palo Alto PA-Series, Fortinet FortiGate, Cisco Firepower, and Check Point Quantum.

Hardware Firewall vs. Software Firewall

Firewalls come in two forms, and a hardware firewall guards the whole network while a software firewall guards one device:

• Hardware firewall: A dedicated physical appliance with a custom OS optimized for packet processing. Sits at the network perimeter between the internet and the internal network. Protects all devices on the network simultaneously. Examples: Cisco ASA, Fortinet FortiGate, pfSense (open-source on commodity hardware). Throughput ranges from 100 Mbps on small office devices to 1 Tbps+ on enterprise chassis.
• Software firewall: A firewall application installed on a host OS. Protects only the device it runs on. Examples: Windows Defender Firewall, macOS Application Firewall, iptables/nftables on Linux. Software firewalls are essential for laptops used outside the corporate network perimeter.

Windows Defender Firewall Configuration Basics

Windows Defender Firewall is the stateful software firewall built into Windows 10 and 11, and it is turned on by default. The basics:

1. Profiles: Windows Defender Firewall applies 3 profiles based on network type: Domain (corporate Active Directory network), Private (home/trusted network), and Public (untrusted network, e.g., coffee shop Wi-Fi). Public profile applies the most restrictive default rules, blocking most inbound connections.
2. Inbound rules: Block all inbound connections that do not match an explicit allow rule by default. Allow only required services: Remote Desktop (TCP 3389—only if needed), file sharing (TCP 445—only on Private profile).
3. Outbound rules: Default allow all outbound. For stricter environments, define allow-list outbound rules to permitted services only.
4. Logging: Enable firewall logging (dropped packets and successful connections) to %systemroot%\system32\LogFiles\Firewall\pfirewall.log for incident investigation.

Two quick ways to add a rule from the command line. netsh: netsh advfirewall firewall add rule name="Block Telnet" protocol=TCP dir=in localport=23 action=block. PowerShell: New-NetFirewallRule -DisplayName "Block Telnet" -Direction Inbound -Protocol TCP -LocalPort 23 -Action Block.

What Is a DMZ (Demilitarized Zone)?

A DMZ is a buffer network between the internet and your internal network, sitting between two firewalls, where you put servers the public needs to reach:

• The layout: the internet meets an external firewall; the DMZ (web, email, DNS servers) sits behind it; an internal firewall separates the DMZ from your private network.
• Why: visitors can reach DMZ servers but cannot touch internal systems directly – if a DMZ server is hacked, the internal firewall blocks the attacker from moving inward.
• What lives there: public web servers, external mail (MX) hosts, VPN concentrators, authoritative DNS, and public API endpoints.

Common Firewall Rules

Most secure setups share a short list of standard rules – mostly closing dangerous doors and opening only the few you need:

• Block inbound TCP port 23 (Telnet): Telnet transmits credentials in cleartext. SSH (port 22) is the encrypted replacement.
• Allow inbound TCP port 443 (HTTPS): Required for encrypted web traffic to web servers.
• Allow inbound TCP port 22 (SSH): For remote server management—restrict source IP to admin network ranges only.
• Block inbound TCP port 3389 (RDP) from external IPs: Remote Desktop Protocol exposed directly to the internet is a top attack vector for ransomware delivery. Restrict to VPN or internal IPs only.
• Block inbound TCP/UDP port 445 (SMB) from external IPs: The SMB protocol (Windows file sharing) is the vector exploited by WannaCry and other network worms. Never expose SMB externally.
• Allow outbound TCP port 443 and 80: Required for HTTPS and HTTP browsing from internal clients.

Comparison of the 4 Firewall Types

This table lines up all four firewall types by the OSI layer they reach, what they inspect, and their performance:

Last Thoughts on What Is a Firewall

A firewall is the front-door guard for network security: it decides what traffic enters and leaves based on rules, from simple header checks in a packet filter to full application- and user-aware inspection in a next-generation firewall. You do not need an enterprise appliance to be covered – the firewall in your router and the one already running in Windows handle the basics by blocking unsolicited inbound and allowing your normal outbound traffic. The wins that matter are small and durable: keep the default-deny posture, close risky inbound ports like Telnet, SMB, and exposed RDP, and turn the firewall on wherever it ships off (looking at you, macOS).

Key Takeaways:

• A firewall filters network traffic against rules, allowing or blocking each packet by source, destination, port, and protocol – and it checks rules top to bottom, acting on the first match.
• Inbound rules keep unrequested traffic out; outbound rules stop malware calling home and limit what leaves. Most firewalls block unsolicited inbound and allow outbound by default.
• The four types – packet filtering, stateful inspection, application (proxy), and next-generation (NGFW) – each inspect traffic more deeply than the last.
• Hardware firewalls protect a whole network at the edge (often your router); software firewalls protect one device and can filter per app.
• Windows Defender Firewall is on by default; macOS’s is off until you enable it. Close inbound TCP 23 (Telnet), 3389 (RDP), and 445 (SMB), and see the types of computer ports for what each one does.

Frequently Asked Questions (FAQs)