What is a firewall? Types and how they work

A firewall is a filter for network traffic. It sits between a network and the rest of the internet, deciding what is allowed through based on rules. This article explains the main types and their limits.

The core idea

Every device has thousands of data ports, each used for a kind of traffic — web on 443, mail on 25, and so on. A firewall examines incoming and outgoing data and applies rules: allow, block, or ask. The goal is to keep unwanted traffic out while letting legitimate traffic through.

Main types

Packet-filtering firewalls

The oldest and simplest type. It inspects each packet's header — source IP, destination IP, port, protocol — and decides based on a rule table. Fast and cheap, but it does not look inside the packet's content.

Stateful firewalls

These track the state of connections. If your computer opened a connection to a server, return traffic on that connection is allowed automatically; an unsolicited packet from outside is not. This is the standard for modern home and office firewalls.

Application (proxy) firewalls

These work at the application layer and can understand the protocol itself (HTTP, SMTP...). They can block specific behaviors — for example, a URL category or a malformed request — not just ports. Slower, but much more precise.

Next-generation firewalls (NGFW)

An evolution that combines stateful filtering with application awareness, intrusion prevention (IPS), and sometimes malware scanning. They inspect traffic deeply and are common in enterprises.

What a firewall protects against

• Unauthorized access — attackers probing open ports cannot reach services you did not open.
• Malware callbacks — some malware phones home; outbound rules can block it.
• Some network-based attacks — port scans, connection floods within rule limits.

What a firewall cannot do

• Block phishing — a firewall does not judge whether a page is fake once HTTPS traffic is allowed.
• Catch malware inside files — downloaded files and attachments are usually passed unless inspected by an additional layer.
• Stop human mistakes — an employee (or user) clicking a malicious link or granting access is outside firewall scope.
• Protect after compromise — sophisticated attackers can tunnel through allowed channels.

Home versus enterprise

Home routers ship with a basic firewall enabled by default (often stateful). For most home users that is enough. Enterprise networks add NGFWs, network segmentation and centralized logging because the threats and compliance needs are greater.

FAQ

What is a firewall and how does it work?

A firewall is a filter for network traffic that sits between a network and the internet, deciding what traffic is allowed through based on predefined rules. It examines incoming and outgoing data packets and applies rules to allow, block, or request authentication for traffic, aiming to keep unwanted traffic out while letting legitimate traffic through.

What are the main types of firewalls?

The main types are packet-filtering firewalls (which inspect packet headers), stateful firewalls (which track connection states), application (proxy) firewalls (which work at the application layer and understand protocols), and next-generation firewalls (NGFW) that combine stateful filtering with application awareness and intrusion prevention.

What can a firewall protect against?

A firewall can protect against unauthorized access to services, malware callbacks (by blocking outbound connections to malicious servers), and some network-based attacks like port scans and connection floods when they occur within rule limits.

What are the limitations of a firewall?

A firewall cannot block phishing attempts (since it doesn't evaluate page content once HTTPS is allowed), catch malware inside downloaded files (unless paired with additional inspection layers), prevent human mistakes like clicking malicious links, or protect systems after they have been compromised (as attackers can tunnel through allowed channels).

Summary

A firewall filters network traffic based on rules, blocking what should not pass while allowing legitimate use. It is a necessary first layer of security, but it is not complete protection — phishing, malware and human error still need other defenses. Used together, they make a network much harder to break into.