What is a firewall and what does it actually do?¶
title: "What is a firewall and what does it actually do?" card_id: "IP-098" status: "complete" source_document: "https://docs.google.com/document/d/1XdbzdiT6vsDPyrgvSRymODFCe_LTGHmzPsbJ1LZXmVk/edit?usp=drivesdk"
What is a firewall and what does it actually do?¶
What is a firewall?
At its most basic, a firewall controls which network traffic is allowed to pass and which traffic is blocked.
A firewall might be a physical device sitting between different networks.
It might be part of a home router.
It might run as software on a laptop, phone or server.
Or it might be built into a larger cloud or corporate network.
So a firewall isn't necessarily a separate box.
It’s a function that examines network traffic and applies a set of rules.
Those rules might consider:
The direction in which the traffic is moving.
The source IP address.
The destination IP address.
The source and destination ports.
Whether the traffic is using TCP, UDP or another protocol.
And whether it forms part of a connection that has already been allowed.
More advanced firewalls may also consider the application involved, the identity of the user or information contained within the traffic.
Once the firewall has examined the relevant information, it decides what to do.
It might allow the traffic to pass.
It might block or reject it.
It might record what happened in a log.
And it might generate an alert.
Imagine a laptop opening a webpage.
The laptop sends traffic towards the web server.
A firewall may allow that outgoing connection and then recognise the returning traffic as part of the same communication.
But if an unrelated system on the internet tries to start a new connection to the laptop, the firewall may block it because there is no rule allowing it in.
That is the basic purpose of a firewall.
It controls traffic according to the rules it has been given.
That doesn't mean a firewall automatically knows whether something is good or bad.
A permitted connection could still involve malicious activity.
Legitimate traffic could be blocked by a badly written rule.
And a firewall can only control the traffic that actually passes through it or reaches the device on which it is running.
You may hear people talk about ports being open or closed.
A firewall can allow or block traffic directed towards a particular port.
But the firewall doesn't create the network service using that port.
The relevant application still has to be running and listening for connections.
Firewall records can be extremely useful because they may show:
Which addresses were involved.
Which ports and protocols were used.
When the traffic was observed.
And whether the firewall allowed or blocked it.
But those records have to be interpreted from the firewall’s position in the network.
A firewall may see private addresses inside a network, public addresses outside it, or translated addresses created as traffic passes between them.
And an entry marked “allowed” doesn't prove that the communication completed successfully.
It only shows that the firewall didn't block the traffic it recorded.
Equally, an entry marked “blocked” doesn't prove that the traffic was malicious.
It shows that the traffic matched a rule which prevented it from passing at that point.
We’ll deal with firewall records separately.
For now, remember the basic principle:
A firewall controls network traffic by comparing it against a set of rules.
It can allow, block and record that traffic.
What any particular firewall saw—and what its decision actually proves—depends on where it was positioned and how it was configured.