What Is a Firewall? Types and How They Protect You

A firewall is a system that inspects network traffic and allows or blocks it according to a set of rules. On a home network it mainly stops unsolicited connections from the internet reaching your devices, while letting the connections you start, such as loading a web page, flow normally.

Firewalls exist at many levels: in your router, in your computer's operating system, in cloud platforms and as dedicated appliances in data centres. They range from simple filters that check addresses and ports to systems that recognise applications and inspect content. This guide explains how each type works and which settings matter at home.

How firewall rules work

Every firewall compares traffic against a list of rules. A typical rule matches on some combination of:

• Direction: inbound (from the network to the device) or outbound.
• Protocol: TCP, UDP, ICMP and so on. See TCP vs UDP for why this distinction matters.
• Source and destination address: single IPs or ranges such as 198.51.100.0/24.
• Source and destination port: for example TCP 443 for HTTPS.
• Interface or zone: the WAN side, the LAN side, a guest network.

Each rule has an action: allow (accept), drop (silently discard) or reject (discard and tell the sender, with a TCP RST or ICMP message). Rules are usually evaluated top to bottom and the first match wins, so order matters. Anything that matches no rule falls to the default policy. A secure configuration uses default deny for inbound traffic: block everything, then allow specific exceptions.

Drop or reject?

Drop gives an outside scanner less information and makes it wait for timeouts. Reject is friendlier on internal networks because legitimate clients fail immediately instead of hanging. Many setups drop on the internet-facing side and reject internally.

Types of firewalls

Stateless packet filters

The oldest type examines each packet on its own, looking only at header fields such as addresses, ports and protocol. It is fast but limited: to let replies to your web requests back in, a stateless filter has to allow all inbound traffic from source port 443, which an attacker can abuse by sending packets from that port. Router access control lists often work this way.

Stateful firewalls

A stateful firewall tracks connections in a state table. When your laptop opens a connection to 203.0.113.10 on port 443, the firewall records it and automatically allows the matching return traffic. An unsolicited packet from that server, or anyone else, has no matching entry and is blocked. Almost every modern firewall, including the one in your home router and the ones built into Windows, macOS and Linux, is stateful.

Application-layer firewalls and proxies

These understand specific protocols such as HTTP, DNS or SMTP. A proxy firewall terminates the client's connection and opens a new one to the server, so it can inspect and enforce rules on the actual requests. A web application firewall (WAF) is a specialised version that sits in front of websites to block attacks like SQL injection and cross-site scripting. WAFs and CDNs often add identifying response headers, which you can see with our HTTP headers checker.

Next-generation firewalls (NGFW)

"Next-generation" describes firewalls that combine stateful filtering with additional features: identifying applications regardless of port, intrusion prevention, URL filtering, user-based rules tied to a directory, and optionally decrypting TLS traffic for inspection. They are standard in business networks. The term describes a feature set, not a formal standard.

Host-based vs network-based

The two complement each other. A laptop on public café Wi-Fi has no home router to protect it, so its host firewall is its only barrier.

Is NAT a firewall?

Not exactly. NAT translates private addresses to a public one, and because unsolicited inbound packets have no translation entry, they are dropped as a side effect. That resembles a stateful firewall, but it is not designed as a security control: UPnP and port forwarding open holes, and IPv6 usually involves no NAT at all. With IPv6, every device can have a globally routable address, so the router's IPv6 firewall must block unsolicited inbound traffic explicitly. Most home routers do this by default, but it is worth confirming.

Firewall examples on common systems

Linux with ufw

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw enable
sudo ufw status verbose

If you are connected over SSH, allow port 22 before enabling ufw, or you will lock yourself out.

Linux with nftables

ufw is a front end; underneath, modern Linux uses nftables. A minimal stateful inbound policy looks like this:

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    ct state established,related accept
    ct state invalid drop
    iif "lo" accept
    meta l4proto { icmp, ipv6-icmp } accept
    tcp dport 22 accept
  }
}

The ct state established,related line is what makes it stateful: replies to outbound connections are accepted, everything else must match an explicit rule. ICMPv6 is allowed because IPv6 depends on it for neighbour discovery and path MTU discovery.

Windows

Get-NetFirewallProfile | Format-Table Name, Enabled, DefaultInboundAction
netsh advfirewall show allprofiles

Windows applies different rules depending on whether the network is classified as Domain, Private or Public. Mark untrusted networks as Public so file sharing and discovery stay blocked.

macOS

Open System Settings → Network → Firewall and turn it on. The macOS application firewall controls which apps may accept incoming connections; Options lets you block all incoming connections or enable stealth mode, which stops the Mac answering probes such as ping.

Essential home firewall settings

1. Keep the router firewall and SPI enabled. SPI (stateful packet inspection) is how many routers label their stateful firewall.
2. Check the IPv6 firewall blocks unsolicited inbound connections.
3. Disable remote (WAN) administration of the router unless you truly need it.
4. Review port forwards and the DMZ setting. Remove anything you no longer use. Our guide to port forwarding covers safe practices.
5. Consider turning off UPnP, which lets any local device open ports without asking.
6. Leave host firewalls on on every computer, especially laptops.
7. Put smart-home devices on a guest or IoT network where the router supports it, isolating them from your computers.
8. Keep router firmware updated, since the firewall is only as good as the software running it.

Then verify from the outside. Our open port checker connects to your public IP from the internet and shows whether a given TCP port is reachable. On a typical home connection with no forwarding rules, every port should report closed or filtered.

Frequently asked questions

Do I need a firewall if I have a router?

Your router's firewall protects devices at home, but keep your computer's host firewall on as well. It protects you on other networks and blocks attacks from compromised devices on your own LAN, which the router never sees.

Should I block outbound traffic?

For home use, allowing outbound traffic by default is normal and practical. Businesses often restrict outbound traffic to limit malware communication and data exfiltration, but this requires maintaining allow-lists for every legitimate application.

Can a firewall slow down my internet?

Basic stateful filtering adds negligible delay. Features such as deep packet inspection, intrusion prevention or TLS decryption need substantial processing power, and on lower-end hardware they can limit throughput.

Why does my firewall block ping?

Many firewalls drop inbound ICMP echo requests to make devices less visible to scans. It does not affect normal browsing, but it means a ping test cannot tell you whether that host is up.