A firewall checks every piece of traffic trying to enter or leave your network and blocks anything that doesn’t match your rules. It sits between your devices and the wider internet like a checkpoint, not a wall.
You rely on one whether you know it or not. Your router has one built in, and your laptop has one running quietly right now.
By the end of this piece you will know what a firewall actually inspects, the different types you will run into, and why it alone won’t stop every threat on the types of malware list.
How a Firewall Decides What Gets Through
Every firewall works from a rulebook listing which ports, protocols, and IP addresses are allowed. Everything else gets dropped by default.
Think of it as a bouncer with a strict guest list, not a vague sense of who “looks fine.” If your rules say port 3389 (remote desktop) stays closed to the public internet, the firewall rejects that connection before it reaches your server.
Most firewalls log what they block too, useful when you need to know whether an intrusion attempt happened once or a hundred times last week.
Packet Filtering vs Stateful Inspection
The oldest firewalls use packet filtering. They check each packet in isolation against the rules and let it through or block it. Fast and cheap, but blind to context.
Stateful inspection firewalls track entire connections instead of single packets. Open a session with a website and the firewall remembers it, allowing the return traffic while still blocking anything unsolicited.
Next-generation firewalls (NGFW) inspect the actual content of traffic, not just headers, catching threats hiding inside otherwise “allowed” ports.
Network Firewalls vs Host-Based Firewalls
A network firewall sits at the edge of your entire network, usually on a router, protecting everything behind it with one ruleset.
A host-based firewall runs on a single machine, like the one built into Windows or macOS. It protects that device even after the laptop connects to a coffee shop network with no perimeter protection at all.
Running both isn’t overkill. It’s defence in depth, and it means one misconfigured router rule doesn’t leave every laptop in your organisation exposed.
What a Firewall Cannot Do
A firewall filters traffic based on rules. It does not read minds, and it will not stop a user from clicking a malicious link in a convincing email.
That’s why phishing keeps working even on networks with strong cloud security architecture behind them. The firewall let the email through because email traffic is, correctly, allowed.
It also won’t catch a trojan already sitting on a device before the rule was written. One disguised as a legitimate download can still phone home over a port your firewall trusts.
Setting Up Rules That Actually Protect You
Start from “deny all” and open only what you need. That single habit blocks more threats than any advanced feature you could add on top.
Review your rule list on a schedule, not just when something breaks. A port opened for a project that ended two years ago is exactly the kind of gap attackers scan for.
Segment your network where you can. If guest Wi-Fi can reach your finance server, your rules need tightening no matter how strong the perimeter looks.
Frequently Asked Questions
Does a firewall stop viruses?
A firewall blocks unauthorised network traffic, but it doesn’t scan files for malicious code. You still need antivirus software to catch a virus arriving through an allowed connection, such as a download or an email attachment.
Do I need a firewall if I already have antivirus software?
Yes. Antivirus scans files and processes on your device. A firewall controls what traffic reaches that device in the first place. They cover different layers, and skipping either one leaves a gap.
Can a firewall slow down my internet connection?
A misconfigured firewall with overly complex rules can add latency. For most home and small business setups, a properly configured firewall has no noticeable effect on speed.
