Quick Summary
- A firewall inspects network traffic and decides whether to allow or block each packet based on a set of rules
- Rules are processed in order from top to bottom -- the first matching rule wins, so priority order matters
- A stateful firewall remembers active connections, so reply traffic is automatically allowed without extra rules
The Security Guard Analogy
Imagine a building with a security guard at the front entrance. Every person who walks up to the door must show a badge. The guard has a clipboard with a list of rules: "Employees with blue badges -- let them in. Delivery drivers between 9 AM and 5 PM -- let them in. Everyone else -- turn them away." The guard checks each visitor against the list, top to bottom, and applies the first rule that matches.
A firewall works exactly the same way, except instead of people and badges, it inspects network packets and checks their source IP address, destination IP address, port number, and protocol. Each packet arrives at the firewall, the firewall compares it against its rule list, and the packet is either allowed through or blocked and dropped. No exceptions, no negotiations.
Firewalls are one of the oldest and most fundamental tools in network security. Every home router has a built-in firewall. Every cloud provider -- AWS, Azure, Google Cloud -- gives you firewall controls (called Security Groups or Network ACLs). Understanding how firewall rules work is essential for anyone who touches a network, whether you are a developer deploying an app or an administrator protecting a company.
How a Firewall Filters Traffic
Packets arrive from the internet. The firewall checks each one against its rules and either allows or blocks it:
In this diagram, HTTP and HTTPS packets match "ALLOW" rules and pass through to the internal servers. The SSH packet hits a "DENY" rule and is silently dropped. The firewall never lets it reach the server. At the bottom sits the default deny rule -- anything that does not match an explicit "ALLOW" is automatically blocked.
Firewalls Step by Step
What Are Firewall Rules?
A firewall rule is a simple instruction: "If a packet matches these conditions, take this action." Each rule specifies conditions like source IP address, destination IP address, protocol (TCP, UDP, ICMP), and port number. The action is either ALLOW (let the packet through) or DENY (drop it silently). Think of each rule as one line on the security guard's clipboard. For example: "Allow TCP traffic from any source to destination port 443" means "let HTTPS connections through."
Allow vs Deny
Every rule ends with one of two verdicts. ALLOW means the packet is permitted to continue to its destination. DENY (sometimes called DROP or REJECT) means the packet is discarded. With DROP, the packet vanishes silently -- the sender gets no response and eventually times out. With REJECT, the firewall sends back an error message telling the sender the connection was refused. Most firewalls use DROP by default because it reveals less information to potential attackers -- they cannot tell if the port exists or if a firewall is blocking it.
Priority Order Matters
Firewall rules are evaluated from top to bottom. The first rule that matches a packet wins -- all rules below it are ignored for that packet. This means order is critical. If you put "DENY ALL" at the top and "ALLOW HTTP" below it, no HTTP traffic will ever get through because the deny rule matches first. The correct approach is to put your most specific ALLOW rules at the top and your broad DENY rule at the bottom. Think of it like a bouncer with a VIP list: check the VIP list first, then deny everyone else.
Default Deny Policy
The golden rule of firewall security is "deny everything by default, then allow only what you need." This is called a default-deny or whitelist policy. You start with a rule that blocks all traffic, then add specific ALLOW rules above it for the services you want to expose. This way, if you forget to write a rule for something, it is blocked -- which is the safe default. The opposite approach (allow everything by default) is dangerous because any service you forget to block is wide open to the internet.
Stateful vs Stateless
A stateless firewall treats every packet independently. It looks at each packet's headers, checks the rules, and decides. It does not remember previous packets. This means you need to write rules for both directions -- one rule to allow outgoing HTTP requests, and another to allow the reply traffic coming back. A stateful firewall, on the other hand, tracks active connections. When you send an HTTP request, the firewall remembers and automatically allows the reply without needing a separate rule. Modern firewalls are almost always stateful because they are simpler to configure and more secure.
Firewalls in the Real World
Firewalls protect everything from home networks to the largest cloud deployments. Here are three everyday examples:
Blocking SSH from the Internet
Your web server runs SSH on port 22 for administration. A firewall rule blocks SSH from the public internet but allows it from your office IP address. This means you can manage the server remotely, but attackers scanning the internet cannot reach the SSH port. This single rule prevents thousands of brute-force login attempts per day.
Allowing Only HTTP/HTTPS
A production web server should only accept traffic on ports 80 (HTTP) and 443 (HTTPS). A firewall with just three rules -- allow port 80, allow port 443, deny everything else -- ensures that no other service on the server is reachable, even if it is accidentally running. This reduces the attack surface dramatically.
AWS Security Groups
In Amazon Web Services, every EC2 instance has a Security Group -- which is essentially a stateful firewall. You define inbound rules (what traffic can reach the instance) and outbound rules (what traffic can leave). Security Groups are deny-by-default: no inbound traffic is allowed until you add a rule. They are the most common firewall you will encounter in cloud infrastructure.
Common Firewall Mistakes
Firewall rules seem simple, but these mistakes cause outages and security holes constantly:
Deny-All Before Allow (Lockout)
You add a "DENY ALL" rule to tighten security, but you accidentally place it above your ALLOW rules. Result: everything is blocked, including your own SSH session. You are now locked out of the server with no way to fix the firewall remotely. Always put your ALLOW rules above the default deny. Better yet, test rule changes with a scheduled revert so a mistake does not leave you permanently locked out.
Blocking ICMP Entirely
ICMP is the protocol behind ping and network error messages. Many administrators block all ICMP thinking it improves security. In reality, blocking ICMP breaks Path MTU Discovery, which can cause mysterious connection failures where some pages load and others hang. It also makes troubleshooting nearly impossible because ping and traceroute stop working. Allow at least ICMP Type 3 (Destination Unreachable) and Type 11 (Time Exceeded).
Forgetting Return Traffic
On a stateless firewall (like AWS Network ACLs), you create a rule allowing inbound HTTP on port 80, but your web server's responses are blocked because you forgot to allow outbound traffic on ephemeral ports (typically 1024-65535). The request gets in, but the reply cannot get out. Stateful firewalls handle this automatically, but with stateless firewalls, you must explicitly allow traffic in both directions.
Beyond the Basics: Types of Firewalls
The simplest type is a packet filter, which examines each packet's headers (IP addresses, ports, protocol) and makes a quick allow/deny decision. This is fast but limited -- it cannot inspect what is inside the packet. Application-layer firewalls (also called Layer 7 firewalls or WAFs) go deeper: they understand HTTP, DNS, and other protocols, and can block specific requests like SQL injection attempts or malicious file uploads. These are commonly used to protect web applications.
Next-generation firewalls (NGFWs) combine packet filtering, stateful inspection, application awareness, and even intrusion detection into a single device. They can identify applications regardless of port (for example, detecting BitTorrent traffic even if it runs on port 443) and apply user-based policies. For home use, your router's built-in firewall handles basic NAT and port filtering. For enterprise and cloud environments, specialized firewalls from vendors like Palo Alto, Fortinet, or the cloud provider's native tools provide the deeper inspection needed for modern threats.
Firewall Best Practices
Start with default deny and add only the rules you need. Document every rule with a comment explaining why it exists -- six months from now, you will not remember why port 8443 is open unless you wrote it down. Review your rules regularly and remove anything no longer needed; stale rules are a common source of security holes. Use the principle of least privilege: allow traffic only from the specific IP addresses and to the specific ports that are required, never broader than necessary.
Log denied traffic so you can spot attack patterns and misconfigured applications. Test your rules from the outside -- do not assume they work. Tools like nmap can scan your server's ports and confirm that only the intended services are reachable. And always have a way to recover if you lock yourself out: a console connection, an out-of-band management network, or a scheduled rule revert that automatically undoes changes if you do not confirm them within a few minutes.
Try It Yourself
Select a source, destination, protocol, and port, then test your packet against the firewall rules. You can also add custom rules.
| # | Source | Destination | Protocol | Port | Action |
|---|
Frequently asked questions about firewalls
What is a firewall?
A firewall is a network device or software that decides which packets are allowed through and which are dropped, based on a configured set of rules. It sits between networks of different trust levels — for example, between your home LAN and the internet — and acts as a policy enforcement point.
What is the difference between stateful and stateless firewalls?
A stateless firewall evaluates each packet on its own. A stateful firewall tracks active connections in a state table, so it can automatically allow return traffic for any session it has previously permitted. Stateful is more flexible and is the default behavior of modern firewalls.
How does a firewall decide what to allow?
Firewalls evaluate packets against an ordered rule set that matches on fields like source IP, destination IP, protocol, and port. The first matching rule wins. Most firewalls end with an implicit deny, so anything not explicitly permitted is dropped.
What is a next-generation firewall (NGFW)?
An NGFW adds application-layer inspection on top of traditional packet filtering. It can identify traffic by application (Slack, BitTorrent, Zoom) regardless of port, decrypt TLS, and integrate intrusion prevention. NGFWs are the standard for enterprise security perimeters today.
Do I need a firewall if I have NAT?
NAT incidentally blocks unsolicited inbound traffic because there is no NAT mapping for it, but it is not a security control. A real firewall enforces explicit allow/deny policy, inspects connection state, and logs decisions — capabilities that NAT alone does not provide.
Try a firewall yourself
You just learned how stateful and stateless firewalls evaluate packets differently. Now run both side by side: trace the same HTTP connection through each, see where the stateless firewall drops the reply, and add the return rule it needs.
Launch the firewall lab →