What Is a Firewall? Network Security Explained Simply

What a firewall actually does

A firewall is a security system that monitors incoming and outgoing network traffic and decides whether to allow or block it based on a set of rules. Think of it as a checkpoint between a trusted network (your computer or home network) and an untrusted one (the internet). Every packet of data that tries to cross is inspected against the rules; anything that does not match an 'allow' rule is dropped. The goal is simple: let through the traffic you want (like loading a web page) while stopping traffic you did not ask for (like an attacker probing your machine).

How rules work

Firewall rules are typically based on attributes like the source and destination IP address, the port number, and the protocol (TCP, UDP, and so on). A rule might say 'allow outgoing traffic to port 443' (which is HTTPS, so web browsing works) while blocking unsolicited incoming connections. Rules are evaluated in order, and most firewalls follow a 'default deny' philosophy: if nothing explicitly permits a connection, it is refused. This is what makes a firewall effective, it assumes traffic is unwanted unless proven otherwise.

Packet-filtering firewalls

The simplest type, a packet filter, examines each packet in isolation, looking only at its headers (addresses and ports) without tracking the broader conversation. It is fast and lightweight but limited: because it does not remember context, it cannot easily tell whether an incoming packet is a legitimate reply to something you sent or an unsolicited probe. Early firewalls worked this way, and packet filtering is still a building block, but on its own it offers fairly coarse protection.

Stateful firewalls

A stateful firewall improves on packet filtering by tracking the state of active connections. When you open a connection to a website, the firewall remembers it and automatically allows the return traffic for that specific conversation, while still blocking unrelated incoming connections. This 'connection awareness' makes the rules both safer and simpler. Stateful inspection became the standard approach for network firewalls because it understands the difference between a reply you expect and traffic you never requested.

Application-layer firewalls

The most sophisticated type inspects the actual content of traffic at the application layer, not just addresses and ports. An application-layer firewall (sometimes called a proxy firewall or, in modern form, part of a 'next-generation firewall') can understand protocols like HTTP and filter based on what the traffic is actually doing, blocking specific web requests, malware signatures, or disallowed applications. This deeper inspection is more powerful but also more resource-intensive, which is why it is often deployed at network boundaries rather than on every device.

You already have firewalls running

You do not need to buy anything to have a firewall, several are already protecting you. Your operating system includes one (Windows Firewall, or the packet filter built into macOS and Linux), and your home router has a firewall that, thanks to a feature called NAT, hides your devices from unsolicited inbound connections by default. For most people, keeping these enabled is enough. The practical takeaway: firewalls are a foundational, always-on layer of defense, quietly dropping unwanted traffic so you rarely have to think about it.

Related on Skillo

See also: What is a VPN vs proxy? The difference explained, How to secure your home Wi-Fi network.

Sources

• Firewall (computing) - Wikipedia

Published date reflects the original event date (2025-03-04). This article is original Skillo editorial written from the sources above; facts were verified in September 2026.