A firewall sits between networks, or on a single computer, and decides which packets are allowed through. It works from a list of rules, each matching things like the source and destination address, the protocol and the port, and saying allow or deny. Rules are checked from the top, and the first match decides.
# Action From To Port
1 allow any 203.0.113.10 443/tcp
2 allow 10.0.0.0/8 203.0.113.10 22/tcp
3 deny any any anyThe last rule there is the important one: default deny. Anything you didn't say yes to is blocked. It's much safer than trying to list everything bad, because you can't know everything bad. Here, anyone can reach the web server on 443, only inside addresses can use SSH, and nothing else gets in.
Early firewalls looked at each packet on its own (stateless). Modern ones are stateful: they remember connections. When your laptop opens a connection out, the firewall notes it and lets the replies back in, while still blocking connections that someone outside tries to start. That's how a home router lets you browse while keeping everything inside unreachable.
Some firewalls also look deeper at the traffic itself, at the application layer: a web application firewall can block requests that look like attacks on a website. And every modern operating system has its own firewall too, so a laptop on café Wi-Fi is protected even with no router of yours in front of it.
Using the rules above, can a computer on the internet reach the server's SSH on port 22?
| Firewall | Allows or blocks traffic by rules. |
|---|---|
| Rule | Match address, protocol and port → allow or deny. |
| First match | Rules are checked top to bottom. |
| Default deny | Block whatever isn't allowed. |
| Stateful | Remembers connections; lets replies back in. |
| WAF | Web application firewall: looks at the requests themselves. |