Firewalls

A firewall is a device (or software) that checks network traffic and decides whether to allow it or block it, following a list of rules written by an administrator. The name comes from buildings: a firewall is a wall that stops a fire spreading from one part of a building to another.

💡 In simple terms: a firewall is the security desk at the entrance of an office building. Staff walk out freely and come back in. Visitors are only let in if they are expected and are going to an allowed place. Everyone else is turned away, and the desk writes it all down in a logbook.

Why firewalls exist

A router's job is to deliver packets. If it knows a route, it forwards the packet. It doesn't ask whether the packet should be delivered. That is a problem when one side of the router is the internet: millions of machines scan the internet all day looking for open doors. A firewall adds the missing question: is this traffic allowed?

• Keep unwanted traffic from the internet out of the private network.
• Control what inside users and devices can reach outside.
• Separate parts of a network that need different levels of trust, such as guests, staff and servers.
• Record what was allowed and blocked, for troubleshooting and security investigations.

Where a firewall sits

At the edge

The most common place is the network edge: the point where the private network meets the internet. All traffic in and out must pass through it, so it is the natural checkpoint.

Between zones

Firewalls group interfaces into zones, each with a trust level. Rules then say what may pass from one zone to another. A common design has three zones:

Larger networks also put firewalls inside the network, for example between the guest Wi-Fi and the office, or in front of the finance servers. Splitting a network this way is covered in Network segmentation.

Network firewalls and host firewalls

Use both. They protect against different things. This idea of several layers of protection is called defence in depth; see Basic network security.

Firewalls also come in other forms: a feature inside a home router, a virtual firewall running on a server, and cloud firewalls (security groups) that protect cloud servers, covered in Cloud networking basics.

Important parts of a firewall

How a firewall decides, in brief

Two ideas matter here. First, a rule list usually ends with an invisible deny everything else: if no rule allows something, it is blocked. Second, modern firewalls are stateful: they remember each conversation started from inside and automatically let its replies back in, without a separate rule. Writing rules and how stateful inspection works are taught in Firewall basics.

What a firewall looks at in a packet

A traditional firewall reads the IP header and the TCP or UDP header. That gives it five facts, often called the 5-tuple:

The destination port tells the firewall which service is wanted: 443 for HTTPS, 22 for SSH, 3389 for Remote Desktop. See Common ports to know. Edge firewalls very often do NAT too, so the addresses can change as the packet passes through.

Next-generation firewalls

Port numbers are a weak clue. Almost everything now runs over port 443, and any program can use any port. A next-generation firewall (NGFW) looks deeper, into the application data itself (Layer 7). It adds features such as:

• Application awareness: it recognises the actual app (a video service, a file-sharing tool) whatever port it uses, and can allow one and block another.
• User identity: rules by person or group ("Finance may use the banking app") instead of only by IP address.
• Intrusion prevention (IPS): it spots known attack patterns in traffic and blocks them.
• URL filtering and malware scanning: it blocks known bad websites and checks downloads.
• TLS inspection: with the organisation's own certificate installed on devices, it can decrypt and inspect encrypted traffic. This is powerful but raises privacy questions.

A real-world example: the home router

Your home router contains a simple firewall. When your laptop (192.168.1.20) opens a website, the router records the conversation and lets the replies back in. When a stranger on the internet sends a connection attempt to your public address 203.0.113.45, the router has no matching conversation and no rule allowing it, so it drops it. That is why your printer and smart TV are not reachable from the internet, unless you open a door yourself with port forwarding.

⚠️ Every port-forwarding rule you add is a hole in that firewall. Only forward what you really need, and remove rules you no longer use.

When a firewall causes problems

A firewall that crashes usually fails closed: it blocks everything rather than letting everything through. That is safer, but it means a firewall outage is a network outage.

Useful commands

Check whether the host firewall is on:

C:\>netsh advfirewall show allprofiles state
Domain Profile Settings:
----------------------------------------------------------------------
State                                 ON

Private Profile Settings:
----------------------------------------------------------------------
State                                 ON

Public Profile Settings:
----------------------------------------------------------------------
State                                 ON
Ok.

$ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    192.168.10.0/24
443/tcp                    ALLOW IN    Anywhere

Test whether a particular port gets through, end to end:

PS C:\>Test-NetConnection 192.168.10.20 -Port 445
WARNING: TCP connect to (192.168.10.20 : 445) failed

ComputerName           : 192.168.10.20
RemoteAddress          : 192.168.10.20
RemotePort             : 445
InterfaceAlias         : Ethernet
SourceAddress          : 192.168.10.11
PingSucceeded          : True
TcpTestSucceeded       : False

Common mistakes

• Thinking “ping works” means the firewall allows everything. Firewalls filter per protocol and port.
• Forgetting the host firewall. The network firewall allows the traffic, but Windows Firewall on the server blocks it.
• Turning the firewall off “just to test” and forgetting to turn it back on.
• Opening a port to “Anywhere” when only a few addresses need it.
• Believing a firewall makes a network safe on its own. It is one layer of protection among several.

Knowledge check

Where to go next

You'll write firewall rules and see stateful inspection in action in Firewall basics. Next in this unit: Wireless access points.