Overview
A firewall is the classic network security control: a barrier that decides which traffic is allowed to pass and which is blocked. Understanding what a firewall is — and what it is not — is foundational to network defense. This lesson introduces firewall concepts.
Learning objectives
- Define a firewall and its purpose.
- Distinguish stateless from stateful filtering.
- Understand where firewalls sit and what they control.
Core concept
A firewall enforces a security policy on network traffic, permitting or denying packets based on rules. Firewalls come in types by how much context they consider:
- Stateless (packet filter) — evaluates each packet independently against rules (source/destination IP, port, protocol), with no memory of prior packets.
- Stateful — tracks the state of connections, so it can allow return traffic for connections it permitted and reject packets that do not belong to any valid connection.
- Application-layer / next-generation — inspects higher-layer content (e.g. HTTP), enabling finer decisions.
How it works
A firewall sits at a boundary — between the internet and an internal network, or between internal zones — and every packet crossing that boundary is checked against the policy. A stateful firewall, the common default, remembers that an internal host initiated an outbound connection and automatically permits the matching replies, while blocking unsolicited inbound traffic. Rules are typically evaluated in order, and traffic that matches no allow rule is dropped (see the default-deny principle in a later lesson).
Practical example
A stateful firewall protecting an office allows internal users to browse the web: when a user's machine opens a connection out to a website, the firewall records the connection and lets the website's responses back in. But an unsolicited connection from the internet toward an internal machine matches no permitted, established connection and is dropped — the difference between traffic the network started and traffic someone outside started.
Cybersecurity relevance
Firewalls are a primary defensive layer, reducing the reachable attack surface by blocking unwanted traffic. But they are not a complete defense: they do not stop attacks carried within allowed traffic (e.g. a web exploit over permitted port 443), and they must be correctly configured to be effective. Analysts test firewall rules for gaps; defenders combine firewalls with other controls (defense in depth, covered later).
Common mistakes
- Thinking a firewall stops all attacks — it controls traffic flow, not malicious content within allowed flows.
- Confusing stateless and stateful — stateful tracks connections; stateless judges each packet alone.
- Assuming a firewall is "set and forget" — misconfiguration and rule sprawl create gaps.
Key takeaways
- A firewall enforces a security policy, allowing or denying traffic at a network boundary.
- Types range from stateless packet filters to stateful firewalls (tracking connections) to application-layer/next-gen firewalls.
- Firewalls reduce attack surface but do not stop attacks inside permitted traffic, and depend on correct configuration.
Check your understanding
- What is the key difference between a stateless and a stateful firewall?
- Why can a firewall permit outbound web browsing yet still block unsolicited inbound connections?