How Firewalls Work

A kid-friendly version of a firewall is a guard at the gate. The guard checks who is trying to come in, where they want to go, and whether the rules allow it. A real firewall does the same kind of job for network traffic, but it works with packets, ports, protocols, and connection state rather than faces and paper badges.

A firewall sits between two trust zones. That might be your laptop and the Internet, a company's office network and the public Internet, or two internal networks with different risk levels. Its job is to enforce a policy such as, "allow outbound web traffic, allow inbound HTTPS to the public website, deny everything else unless explicitly approved".

What a firewall actually checks

At the simplest level, a firewall can inspect packet headers: source IP, destination IP, source port, destination port, and protocol. That is the basis of packet filtering. It is fast and cheap, but also blunt. A rule that allows TCP port 443 cannot tell whether that traffic is a legitimate web session or something malicious tunnelling over the same port.

Most modern firewalls are stateful. Instead of judging each packet in isolation, they keep a connection table. If your machine opens a TCP session to a web server, the firewall records that session and lets the return packets back in because they belong to an established flow. That is why home routers can block unsolicited inbound traffic while still allowing you to browse normally.

Some firewalls go further and act as application proxies. They terminate the client connection, inspect the higher-level protocol, then create a second connection onward. That makes deeper policy checks possible, such as validating an HTTP request format or enforcing web filtering rules. It also adds latency, complexity, and operational cost.

Where firewalls live

A host-based firewall runs on one device. Windows Defender Firewall and Linux nftables are examples. They are useful because they can apply rules close to the process and protect a machine even when it moves between networks.

A network firewall protects many devices at once. It may be a dedicated appliance, a virtual firewall in a cloud network, or built into a router. In practice, mature environments use both: central controls at the network edge and local controls on each endpoint.

What "next-generation" usually means

A next-generation firewall usually combines stateful filtering with intrusion prevention, application awareness, identity-based rules, and sometimes TLS inspection. That sounds powerful because it is. It also creates hard tradeoffs. TLS inspection means the firewall effectively performs a controlled man-in-the-middle operation, which affects privacy, certificate management, and performance.

What firewalls cannot do alone

A firewall is not a general cure for security problems. If you allow a user to visit a malicious website over HTTPS, the traffic may still be perfectly valid from the firewall's point of view. If a compromised employee laptop makes an allowed outbound connection, the firewall may permit it. Bad rules can be as dangerous as no rules, especially when people add broad "temporary" exceptions and forget them.

A good firewall policy is usually boring: least privilege, explicit allow rules, careful logging, and regular review. The device matters, but the rule set matters more. A firewall is best understood as a policy enforcement point, not as magic armour.