People imagine firewalls as intelligent guardians, somehow sensing malicious traffic. The reality is more boring and more useful to understand: a firewall is a bouncer with a clipboard. It examines each connection's basic facts — where it's from, where it's going, which port, which protocol — checks them against a written list of rules, and does whatever the first matching rule says. No judgement, no understanding. Just the list.
How the list works
Rules are evaluated top to bottom, first match wins. A typical list reads like:
- Allow anyone to reach the web server on port 443
- Allow the office network to reach the file server
- Allow replies to conversations that started from inside
- Deny everything else
That last line is the entire philosophy of the trade in four words: default deny. You don't list what's forbidden — the list of bad things is infinite. You list the small set of things that are explicitly permitted, and everything unlisted bounces. Every well-run firewall ends with that line, and "does this end in deny-all?" is a legitimate first question when reviewing any firewall you inherit.
The word "stateful" — the one upgrade that matters
Early firewalls judged each packet in isolation, which created a puzzle: if you browse a website, the replies come from the internet toward you — should inbound traffic from random web servers be allowed? A stateful firewall solves this by remembering conversations: it saw your outbound request, so it recognises the returning traffic as a reply and lets it through — while identical-looking packets that aren't replies to anything get bounced. The bouncer remembers who went out for a cigarette. Essentially every firewall you'll ever touch is stateful; the term appears in every exam and job spec, and now it's just intuitive.
Troubleshooting habit worth building on day one: when something can't connect and the network looks healthy, find the firewall in the path and read the rules before theorising. A colossal share of "the network is broken" tickets end at a rule someone forgot — and the machines were fine all along.
One scope note: the firewall in your router guards the network's border, and the firewall built into Windows or macOS guards a single machine. Same clipboard logic, different door — and defence in depth means both bouncers stay on shift.