What is a firewall?
Choose an answer, then check it.
Cybersecurity · Foundations
Firewalls
On this page 9 sections
In 30 seconds
A firewall A device or program that controls the flow of network traffic between networks or hosts that employ differing security postures; in plain terms, a system that filters traffic between networks based on rules. Full entry → is a system that filters traffic between networks based on rules. It sits at the boundary between a trusted network, like a home or office, and an untrusted one such as the Internet, and it decides what crosses that line. Rules can permit or block traffic by address, port, and type. Firewalls come as devices that guard a whole network or as software that guards a single computer. The safest philosophy is default deny The philosophy of blocking all traffic that has not been expressly permitted by policy, then allowing only the specific traffic a network needs; NIST recommends it as the more secure posture. Full entry →: block everything except what is explicitly allowed. A firewall is a gatekeeper, not a magic wall — it cannot stop everything.
Why this matters
Every home router and every office network edge contains a firewall, which makes it the most common security control most people will ever rely on. Understanding what a firewall actually decides — and what it cannot see — separates a realistic view of network defense from the comfortable myth that a firewall means you are protected. Academically, the firewall introduces the core pattern of security policy: deciding what is allowed and what is not, and defending that decision. Looking forward, its limits explain why layered defenses exist: encrypted traffic, insider actions, and social engineering all slip past a gatekeeper, so protection never ends at the boundary.
The college version
What a firewall is
The authoritative definition comes from NIST SP 800-41, the U.S. government's guideline on firewalls: a firewall is a device or program that controls the flow of network traffic The data moving between computers over a network, such as web requests, email, and file transfers; firewalls filter this traffic at the boundary. Full entry → between networks or hosts that employ differing security postures. In plainer terms, a firewall is a system that filters traffic between networks based on rules. Cloudflare's explainer puts the same idea in everyday language: a firewall is a security system that monitors and controls network traffic based on a set of security rules, and it usually sits between a trusted network and an untrusted one — most often the Internet. The definition matters because it sets expectations: a firewall is a filter and a rule-enforcer, not a sensor that understands everything moving through it.
The gatekeeper at the boundary
The core image for a firewall is the gatekeeper: it decides what crosses the boundary. A network that trusts its own machines and data — the office network, the home Wi-Fi — meets the untrusted Internet at one edge, and the firewall sits on that edge with an external interface facing out and an internal interface facing in. NIST describes exactly this placement: firewalls are often placed at the perimeter of a network, and their policies work in both directions. A concrete example: a music school's network lets students reach the public course catalog and lets the registrar's office send email, but the same firewall blocks outgoing file transfers of the school's recording library because no rule permits them. Filtering is not one-way; the gatekeeper checks traffic leaving as well as arriving.
How filtering works: rules
A firewall decides by comparing traffic against a set of rules — what NIST calls the firewall policy The documented decision of how a firewall should handle inbound and outbound traffic for specific addresses, protocols, applications, and content types. Full entry →: how the firewall should handle inbound and outbound network traffic for specific IP addresses and address ranges, protocols, applications, and content types. Conceptually, the rule looks at three kinds of labels on the traffic. Address: where the traffic claims to come from and where it is going. Port: which numbered service channel the traffic targets, such as the channel a web server or an email service listens on. Type of traffic: what kind of communication it is, such as the underlying transport protocol or the application involved. If traffic matches an allow rule, it passes; if it matches a block rule, it is dropped; if nothing matches, the firewall's underlying philosophy decides. The lesson here is the concept — rules about what is allowed in and out, named by address, port, and traffic type — not how to write such rules for a particular product.
Two forms: the device and the program
Firewalls come in two broad forms, and the difference is where they live. A network firewall A firewall device placed at the edge of a network that filters traffic for everything behind it, with one interface facing the outside and one facing the inside. Full entry → is a device placed at the edge of a network — NIST describes it with an external and an internal interface — and it filters traffic for everything behind it. One line: the device at the network edge guarding the whole network. A host-based firewall Software running on a single computer that monitors and controls that computer's own incoming and outgoing traffic; a personal firewall on a laptop is an example. Full entry → is a program running on a single computer, monitoring and controlling that computer's own incoming and outgoing traffic; a personal firewall on a laptop is the familiar example. One line: the program on a single device guarding that device. The two work well together: Cloudflare notes that firewalls were originally hardware appliances while many modern firewalls are software-based, and a laptop carried between networks carries its own protection with it. A network firewall does not protect a laptop on someone else's Wi-Fi; a host-based firewall does not protect the server room.
Default deny vs default allow
Every firewall needs a stance for traffic that no rule mentions, and that stance is the key decision. Default deny means block everything except what is explicitly needed: the policy starts closed, and rules open specific doors — this address may connect, this port may pass, this application may leave. NIST defines it precisely: deny by default is to block all inbound and outbound traffic that has not been expressly permitted by firewall policy, and NIST recommends it, stating that it decreases the risk of attack and is a more secure approach than permitting all traffic that is not explicitly forbidden. default allow The philosophy of permitting all traffic except what is explicitly blocked; riskier than default deny because every unlisted service stays exposed. Full entry → is the opposite philosophy: everything passes unless a rule explicitly blocks it. The key idea is which side of the ledger mistakes land on. Under default allow, every service you forget to block is exposed; under default deny, every service you forget to allow is closed. NIST is also honest that organizations often apply less stringent policies to outbound traffic, because users legitimately need to reach a huge range of external services — the philosophy is a starting point, applied thoughtfully per direction.
What a firewall cannot do
The honest framing is that a firewall is a gatekeeper, not a complete wall, and NIST states the reason plainly: firewalls can only work effectively on traffic that they can inspect. Three limits follow directly. Encrypted tunnels: traffic protected by encryption — a secure web session, a virtual private network, encrypted email — arrives as unreadable wrapping, so the firewall cannot see inside it; NIST notes that firewalls also may not understand tunneled traffic even when it is not encrypted. Insider threats: an attack that moves from one internal host to another often never crosses the network firewall at all, and an attacker who compromises a machine with administrator privileges can disable or circumvent that machine's own host-based firewall. Social engineering: attacks that manipulate people rather than systems — convincing someone to reveal a password or approve a payment — never need to defeat a firewall, which is why CISA's guidance centers on verifying requests through another channel. The conclusion is not that firewalls are weak; it is that they are one layer, and defense-in-depth — segmentation, patching, awareness, and the rest — covers what a gatekeeper cannot see. Those layers are their own topics.
Eli explains
The same idea, in plain words
Explain it like I’m 10
A firewall is the gatekeeper of a network. Every message that wants to come in or go out must pass it, and it decides based on a list of rules: who may talk to whom, on which channel, and about what kind of business. The list is written by the people who own the network. If a message matches a rule, it passes; if not, it is dropped. A well-run firewall starts by letting almost nothing through, then opens doors one at a time — and only for the services the network actually needs. It is a filter, not a guard who knows everyone in the world.
Picture it like this
Think of a busy office building with one front desk. Everyone who enters must sign in, and every package must match the day's delivery list; nothing walks out without a reason. The desk clerk does not know every person in the city — the clerk only checks the boundary. A firewall is that front desk between your network and the Internet. It checks the passes on traffic coming in, checks the paperwork on traffic going out, and turns away anything that does not match the list. It does not care what happens in the elevators, and it cannot tell whether a polite visitor plans trouble later. It just checks passes at the door.
Where the picture stops working
The front desk guards one entrance, but a network has more ways in and out than a building: laptops connecting from coffee shops, phones on cellular data, and software that opens its own tunnels. And unlike a clerk, a firewall cannot read intent — it inspects the labels on traffic, not the meaning inside it. Encrypted messages arrive as sealed envelopes the desk cannot open, attacks that never cross the boundary never reach the desk, and people who are talked into handing over their keys let trouble in past every checkpoint.
Worked example
Maple Row Dental, a five-chair practice, replaces its router. The new router's firewall starts in default-allow mode, so everything not explicitly blocked is permitted. The office manager, guided by the principle that deny by default is more secure, switches the stance: the front-desk computers may reach the practice-management server on the channel it listens on, patients may reach the booking page, and email flows to the mail provider; everything else is refused. Weeks later, a hygienist's laptop picks up malware at home. When the laptop joins the office network and the malware tries to phone home, the firewall drops the outbound connection — no rule in the ruleset permits it, and under default deny an unlisted connection does not pass. The practice sees the firewall working. It also sees the limit when a caller impersonating the software vendor talks a receptionist into revealing a password: the firewall never even saw that conversation, because it never crossed the network boundary as traffic. Both lessons — the gatekeeper's strength and its reach — come from the same honest understanding.
Key takeaway
A firewall is a gatekeeper that filters traffic between networks according to rules — most safely set to default deny. It is one layer of defense, not a complete wall: encrypted tunnels, insider threats, and social engineering slip past any gatekeeper.
Quick check
3 questions here, of 5 in this lesson’s practice set. Answers stay hidden until you check.
Firewall rules are typically written against which kinds of information about the traffic?
Choose an answer, then check it.
A small clinic's firewall currently runs in default-allow mode. Which change best describes moving it to default deny?
Choose an answer, then check it.
Study tools & related lessonsYou’ll learn to · Common mistakes · Easily confused · Key vocabulary · Related
You’ll learn to
- Define a firewall as a system that filters traffic between networks based on rules.
- Explain the gatekeeper role of a firewall: it decides what crosses the boundary between a trusted and an untrusted network, in both directions.
- Distinguish network firewalls (devices at the network edge) from host-based firewalls (software on a single device).
- Compare the default-deny and default-allow philosophies and explain why default deny is the more secure posture.
- Analyze what a firewall cannot do — encrypted and tunneled traffic, insider threats, and social engineering — and why it is one layer of defense rather than a complete wall.
Common mistakes
Thinking that having a firewall means you are protected.
A firewall filters traffic at the boundary, and only traffic it can inspect. Encrypted traffic, attacks between internal hosts, and social engineering do not stop at the gate, so a firewall is one layer of defense, not a complete wall.
Confusing default deny with default allow.
Default deny blocks everything not expressly permitted and then opens specific doors; default allow permits everything except what is explicitly blocked. NIST recommends default deny as the more secure approach because unlisted services stay closed rather than exposed.
Believing only large organizations need firewalls.
Home routers include firewall function, and any network boundary — even a household's — is a place where filtering helps. The gatekeeper idea scales from a home router to a data center; only the rules change.
Assuming one firewall covers every device.
A network firewall guards the traffic that crosses the network edge; it does not protect a laptop on a coffee shop's network. A host-based firewall on the device itself covers that gap. The two forms are complements, not replacements.
Easily confused
Network firewall vs. Host-based firewall
A network firewall is a device at the edge of a network filtering traffic for everything behind it; a host-based firewall is software on one device filtering that device's own traffic. The first guards the boundary, the second guards the individual machine wherever it goes.
Default deny vs. Default allow
Default deny blocks everything not expressly permitted and opens only needed doors; default allow passes everything except what is explicitly blocked. NIST calls default deny the more secure approach because mistakes land on the side of closed.
Firewall vs. Network segmentation
A firewall filters what crosses a boundary between networks; segmentation divides the inside of a network into separate zones so that one compromised area does not reach the rest. Segmentation is a sibling topic; the firewall is the gatekeeper between the zones.
Key vocabulary
- firewall
- A device or program that controls the flow of network traffic between networks or hosts that employ differing security postures; in plain terms, a system that filters traffic between networks based on rules.
- network traffic
- The data moving between computers over a network, such as web requests, email, and file transfers; firewalls filter this traffic at the boundary.
- firewall rule
- A single instruction a firewall follows, stating that certain traffic is allowed or blocked based on address, port, or type of traffic; the set of rules is called a ruleset.
- firewall policy
- The documented decision of how a firewall should handle inbound and outbound traffic for specific addresses, protocols, applications, and content types.
- default deny
- The philosophy of blocking all traffic that has not been expressly permitted by policy, then allowing only the specific traffic a network needs; NIST recommends it as the more secure posture.
- default allow
- The philosophy of permitting all traffic except what is explicitly blocked; riskier than default deny because every unlisted service stays exposed.
- network firewall
- A firewall device placed at the edge of a network that filters traffic for everything behind it, with one interface facing the outside and one facing the inside.
- host-based firewall
- Software running on a single computer that monitors and controls that computer's own incoming and outgoing traffic; a personal firewall on a laptop is an example.
Sources & references
- NIST SP 800-41 Revision 1: Guidelines on Firewalls and Firewall Policy — National Institute of Standards and Technology
- What is a firewall? — Cloudflare Learning Center — Cloudflare
- Avoiding Social Engineering and Phishing Attacks (ST04-014) — CISA (Cybersecurity and Infrastructure Security Agency)
EliExplains lessons are original prose written from the open, credible references above. See Copyright & Licensing.
Researched 2026-08-21
Educational content only. It is not medical, legal or professional advice. Found an error? Tell us.