Every device you own is, in principle, reachable from anywhere on Earth. Your laptop has an address, and anyone can knock on it — millions of automated scans do exactly that, every day. The reason your files are not ransacked hourly is a piece of software you probably never think about: a firewall. It stands between your devices and the internet like a bouncer at a club door, checking every packet of data against a list and turning away anything that should not be there. Here is how it makes those decisions.
What a firewall actually is
A firewall is software — sometimes running on a dedicated box, sometimes built into your router or operating system — that inspects network traffic and decides, packet by packet, what is allowed through and what is blocked. All internet data travels in packets: small chunks, each with a header acting as a label. The header says where the packet came from, where it is going, which protocol it uses, and which port it is aimed at — think of ports as numbered doors on a building. Port 443 is the door for secure web traffic; port 25 is the door for email.
The firewall reads those labels and applies its rules. A typical home rule set is simple: anything your devices asked for may come back in; anything nobody asked for stays out. That one principle stops the vast majority of random internet attacks.
The three questions every firewall asks
Strip away the jargon and every firewall decision comes down to three questions:
- Who are you? The source IP address identifies the sender. A firewall can block whole countries, known attack networks, or a single address that keeps misbehaving.
- Where are you going? The destination port says what service is being requested. A web server should accept traffic on ports 80 and 443 — and nothing else. A firewall can shut every other door.
- Are you expected? This is the clever one. When you visit a website, your computer sends a request out; the reply that comes back is expected. A stranger's packet arriving uninvited is not. Firewalls that track this are called stateful — they remember conversations, not just individual packets.
The default stance matters too. Good firewalls use default-deny: everything is blocked unless a rule explicitly allows it. The alternative, default-allow, only blocks what is specifically forbidden — and anything the administrator forgot to forbid walks straight in.
The four generations of firewall
Firewalls were invented in the late 1980s, when the internet was small enough that a single worm could infect a tenth of it. The technology has evolved in four clear generations:
- 1988 — Packet filters. Engineers at Digital Equipment Corporation (DEC) built the first packet-filter firewalls, checking each packet's header in isolation and allowing or dropping it by rule. The trigger was the Morris worm of November 1988, which infected around 6,000 hosts — roughly 10% of the entire internet at the time.
- 1989–1990 — Stateful inspection. Researchers at AT&T Bell Labs built firewalls that remembered connections, so they could tell a legitimate reply from an unsolicited probe. Check Point commercialised the idea in 1993–94, and stateful inspection became the industry standard.
- 1990s — Application-layer firewalls and proxies. These go further and understand the application itself: they can tell a genuine web request from a malformed one, and a proxy can fetch content on your behalf so the outside world never talks to your computer directly.
- 2009 onwards — Next-generation firewalls (NGFW). The term was coined by Gartner in 2009. NGFWs add deep packet inspection (DPI) — looking inside the packet's contents, not just its label — plus awareness of which application is running, intrusion prevention, and malware scanning in one box.
Stateful inspection, step by step
Here is what happens when you open a website, with a stateful firewall in the middle:
- Your browser sends a request packet to the website. The firewall checks its rules, allows it, and writes an entry in its state table: "this computer asked that server for a web page, just now."
- The website replies. The firewall checks the reply against the state table, finds the matching entry, and lets it through.
- An hour later, a stranger's computer sends a packet to the same port on your machine. The firewall finds no matching entry in the state table — nobody asked for this — and drops it silently.
- When the conversation ends, the entry expires and the door closes again.
That state table is the whole trick. A simple packet filter can be fooled by a fake packet with a plausible-looking header. A stateful firewall demands the full story: the right addresses, the right ports, the right sequence numbers, and a conversation that actually started from the inside.
The four types at a glance
| Type | What it checks | Strength | Weakness |
|---|---|---|---|
| Packet filter | Packet headers only | Fast, cheap, simple | No memory; easily fooled |
| Stateful inspection | Headers + connection state | Knows what is expected | Cannot see inside packets |
| Proxy / application-layer | The application protocol | Deepest understanding | Slower; can break apps |
| Next-generation (NGFW) | Contents, apps, threats | All-in-one protection | Complex and expensive |
Where firewalls live in your life
You are already protected by several firewalls, whether you know it or not:
- Your home router has a firewall built in. It also uses NAT (network address translation), which hides your devices behind a single public address — the internet cannot see your laptop at all, only the router.
- Your operating system has one too: Windows Defender Firewall and the macOS firewall both run by default, guarding the individual device.
- Your phone sandboxes every app, which is a different kind of wall, and mobile networks filter traffic before it reaches you.
- At work or school, a dedicated hardware firewall guards the whole network, usually an NGFW that also blocks malware and suspicious websites.
What a firewall cannot do
A firewall is a guard at the door, not a bodyguard. It cannot protect you from threats that walk in through the front door:
- Phishing. If you click a malicious link yourself, the firewall sees ordinary web traffic — because you asked for it.
- Malware you install. A downloaded program that phones home looks like normal traffic to the firewall.
- Encrypted traffic. Most web traffic is now encrypted, so a firewall cannot inspect the contents without special TLS inspection — which raises its own privacy questions.
- Insiders and stolen passwords. A firewall cannot tell a legitimate user with a stolen password from the real owner.
That is why a firewall is one layer among several. It works alongside a VPN on public Wi-Fi, two-factor authentication on your accounts, and a password manager for unique passwords — each covering a weakness the others cannot.
Takeaway checklist
- A firewall inspects every packet against a set of rules and allows or blocks it based on its header: source, destination, port and protocol.
- The best default is default-deny: block everything unless a rule explicitly allows it.
- Stateful firewalls remember conversations, so they can tell a reply you asked for from a probe nobody invited.
- Four generations: packet filters (1988), stateful inspection (1989–90), application-layer proxies (1990s), next-generation firewalls with deep packet inspection (from 2009).
- You already have several firewalls: in your router, your operating system, and your phone — leave them switched on.
- A firewall cannot stop phishing, malware you install, or stolen passwords — pair it with a VPN, two-factor authentication and a password manager.
Internal links: What Is a VPN, Really? · How Ransomware Actually Works
