What Is a Firewall? The Plain-English Guide (and What It Does Not Protect You From)

CodexFuse Team · 2026-10-26T21:20:49.627Z · 17 min read

If you have ever seen your computer ask whether to allow an app through the firewall, you have met the guard at the door of your network — and what is a firewall, exactly, is the question this guide answers in plain English. A firewall is a hardware device or a software program that filters the information moving between your devices and the internet, examining each piece of data to decide whether it should be allowed or blocked. You almost certainly already have at least two of them running right now: one built into your home router, and one built into your laptop. This guide explains how they work, the five types you will actually meet, how to check yours is switched on, and — just as important — what a firewall does not protect you from.

Firewalls sit at the heart of the what is an SSL certificate side of website security: encryption protects data in transit, while a firewall decides which traffic is allowed to reach you at all. The two work together, and neither replaces the other.

What is a firewall?

A firewall is a security system that sits between a trusted network — your home, your office, your website's server — and an untrusted one, usually the internet, and controls which traffic may pass between them. Every piece of data that tries to enter or leave is checked against a set of rules, and anything that does not match an allowed rule is blocked. Microsoft Support puts it simply: data flows in and out of devices through ports, and a firewall controls what is allowed through those ports, like a security guard standing at the door checking the ID of everything that tries to enter or exit.

The name comes from building construction, where a firewall is a wall built to stop fire spreading from one part of a building to another. A network firewall does the same job for data: it keeps damage on the outside from spreading to your valuable stuff on the inside. Okta describes the job as three steps, and every firewall — from a ten-dollar router to an enterprise appliance — follows them:

1. Inspect. Traffic entering and leaving your system is examined, packet by packet.
2. Decide. Each packet is compared with the rules you (or your device's maker) defined.
3. Act. Traffic that follows the rules is allowed through; traffic that does not is rejected.

That three-step loop runs constantly, in real time, on every connection your devices make. When it works properly, a firewall blocks some kinds of harmful traffic while letting your normal work move forward without you noticing it is there.

How does a firewall work?

A firewall works by reading the "envelope" of every packet of data — its source and destination addresses, the port it is heading for, and the protocol it uses — and comparing those details with its rule list. A packet is simply a small chunk of data travelling across a network, and everything your devices send or receive is broken into packets before it moves. If the envelope matches an allowed rule, the packet passes; if it matches a blocked rule, it is dropped; if it matches nothing, the firewall's default policy decides, and for incoming traffic that default is almost always "block".

Microsoft's guidance for home networks is blunt: the firewall should allow very little, if any, inbound traffic, because there is rarely any legitimate reason for other devices to connect to your device or home network uninvited. Outbound traffic is treated differently — your browser asking a website for a page is outbound, and it is allowed, while the website's reply comes back as part of that same established conversation rather than as a new inbound connection. That distinction is why a firewall can block strangers from reaching your computer while your own browsing still works.

Modern firewalls look deeper than the envelope when they need to. Next-generation firewalls add deep packet inspection, which reads inside the packet's contents, plus application awareness, intrusion prevention, and URL filtering, according to Cisco. That deeper look is what lets a firewall tell the difference between a normal web request and a request carrying an attack — something the earliest firewalls, which only read addresses and ports, could not do.

Hardware vs software firewalls: which one protects you?

You are protected by both kinds at once, and that is by design. A hardware firewall sits at the edge of your network, usually inside the router that brings the internet into your home or office, and screens traffic before it reaches any of your devices. A software firewall runs on the device itself — Windows, macOS, and your phone each have one built in — and takes a closer look at traffic on that one machine. McAfee's guide makes the trade-off clear: the hardware firewall is a good first line of defence that needs almost no configuration, but it only protects you while you are at home; the moment you take your laptop to a café, only the software firewall travels with you.

The two layers complement each other, and that layering is the point. A stranger's scan of your home network hits the router first and goes no further; a program that somehow gets onto your laptop and tries to send your files out is caught by the software firewall on its way out. Neither layer on its own covers both directions, which is why security guides tell you to keep both switched on rather than choosing between them.

What are the five types of firewalls?

Firewalls come in five main types, and they differ in how deeply they look at traffic. The older types are faster and simpler; the newer types are slower and smarter. Most home users never choose a type — their router and laptop pick for them — but knowing the five helps you understand what a product is actually selling you when it says "firewall".

A packet-filtering firewall is the oldest type: it reads the envelope of each packet and allows or blocks it on addresses, ports, and protocol alone, but it cannot see inside the packet, so it is the least effective against sophisticated attacks, as Cisco notes. A stateful firewall fixes the biggest weakness of that approach by remembering which connections are already open — a packet that belongs to a conversation you started is treated differently from a packet that arrives out of nowhere. A proxy firewall goes further still, acting as an intermediary that inspects full application-layer traffic such as web requests and email commands, and hiding your internal addresses in the process, according to McAfee.

A next-generation firewall is what businesses buy today: it combines traditional filtering with deep packet inspection, intrusion prevention, application awareness, and sometimes encrypted-traffic inspection, so it can identify threats that ride inside otherwise legitimate traffic. The traditional types work at layers 3 and 4 of the networking model — addresses and ports — while an NGFW adds layer 7, the application layer, plus user identity, as the Teldat glossary explains. Cloud firewalls, sold as firewall-as-a-service, move the whole job into the cloud so one policy covers every employee and office, which is why they suit remote and multi-site teams.

Website owners meet one more type: the web application firewall, or WAF. A WAF protects a website or web app specifically, filtering the HTTP requests sent to it to block attacks such as SQL injection and cross-site scripting. It is the firewall that guards your site rather than your laptop — and if you run a site, checking it for malware is the companion step, which is what a website malware scanner does.

Do you need a firewall?

Yes — and you almost certainly already have one. Nearly 95 percent of companies have firewalls, and most of them call the firewall a critical part of their infrastructure, according to the eWeek survey cited by Okta. For home users the question is not whether to buy one but whether the ones you already own are switched on. Your router has one, your Windows PC has Microsoft Defender Firewall, and your Mac has a built-in firewall too. A third-party security suite may take over the job instead, in which case Windows will tell you another provider is handling it.

There are exactly two situations where a firewall matters most. The first is at home, where the router's firewall is the only thing standing between every device on your network — including smart TVs, cameras, and anything else you connected once and forgot — and the open internet. The second is on public Wi-Fi, where the network is shared with strangers and your laptop's software firewall is the only barrier. On a café or hotel network, treat your connection as untrusted and make sure the firewall is on before you do anything that involves a password.

The one honest exception is that a firewall is a baseline, not a complete security system. Okta's own line is that no firewall is infallible, and even hobby hackers know how to get around simple ones — so monitoring and the other layers of security still matter. That is not a reason to skip the firewall; it is the reason to treat it as the first layer rather than the only one.

How to check your firewall is on

Checking takes about a minute, and it is worth doing on every device you own, because a firewall that was switched off during troubleshooting sometimes never gets switched back on. Here is the check for each device, verified against current Windows and macOS guidance.

Windows 11: check Microsoft Defender Firewall

1. Click Start, type Windows Security, and open the app.
2. Click Firewall & network protection. You will see three entries: Domain network, Private network, and Public network. The one marked "active" is the profile Windows is using right now.
3. Click the active network type. For a home network this is usually Private; a café or hotel Wi-Fi is normally Public.
4. Under Microsoft Defender Firewall, the switch should be On. If it is off, move it to On — you may need an administrator password.

If the switch is greyed out, or Windows Security says the settings are managed by your organisation, a work or school policy is controlling the firewall and only your administrator can change it. A third-party security suite can also take over: in that case Windows Security says another provider is handling it, and you manage the firewall inside that product instead.

macOS: check the built-in firewall

1. Open System Settings and click Network in the sidebar.
2. Click Firewall. If it says Off, click the switch to turn it on.
3. Click Options to see the details: macOS can block all incoming connections, and you can allow or block individual apps there.

Your router: check the hardware firewall

Log in to your router's admin page — usually by typing its address, such as 192.168.1.1, into a browser — and look for a Firewall or SPI Firewall setting under Security or Advanced settings. On most home routers it is on by default, and the correct action is simply to confirm it is enabled and leave it alone. While you are there, check two things that matter more than any firewall setting: change the router's default admin password if you never have, and turn off remote administration unless you genuinely need it.

Firewall vs antivirus: what is the difference?

A firewall is not antivirus, and antivirus is not a firewall — they guard different doors. A firewall controls network traffic: what may enter or leave your device over a connection. Antivirus looks at the files and programs already on your device and decides whether any of them is malicious. One stops the burglar at the gate; the other searches the house for intruders who are already inside. You need both, because each is blind to the other's job.

NETGEAR's own support pages say the same thing plainly: a firewall does not secure against every kind of attack, and you still need to run a virus checker on all your computers and mobile devices. The confusion is understandable, because security suites bundle both into one product with one icon — but under the hood they are two separate engines, and turning one off does not leave the other able to cover for it.

What a firewall does not protect you from

A firewall is a strong first layer, and it is also easy to over-trust. Here is what it cannot do, stated plainly so you do not mistake a switched-on firewall for total safety.

• Phishing emails you click. If you open a convincing email and type your password into a fake login page, the firewall sees normal web traffic — you asked for the page, so it let it through. Stopping phishing is the job of your judgement, your email filter, and two-factor authentication.
• Malware already on your device. A firewall can block a bad program from phoning home, but it cannot remove a virus that is already installed or stop it from damaging your files. That is the antivirus's job.
• Traffic it cannot see. An encrypted connection the firewall is not set up to inspect is, by design, unreadable to it — which is why a VPN is not a replacement either. A VPN encrypts your traffic so others cannot read it; a firewall decides which traffic is allowed at all. They solve different problems.
• Weak passwords. A firewall cannot stop someone logging in with a password you reused from a breached site. Password strength is a separate discipline — the NIST password-length rules explain how long a password should actually be.
• Physical access. Someone holding your unlocked laptop does not need to cross your network at all. A firewall guards the network; your screen lock guards the device.

None of this makes the firewall useless — it makes it one layer in a stack. The stack, in plain terms, is: firewall on, software updated, antivirus running, strong unique passwords, two-factor authentication where it matters, and a healthy suspicion of unexpected attachments and links. Leave any one layer out and the rest have to work harder.

Firewalls for small businesses: the five-minute version

If you run a small business, the firewall conversation is the same as the home one, with one addition: your router protects your office network, but it does not protect the staff member working from a café. A business needs the same check on every laptop, the same "on" state on the office router, and a rule about public Wi-Fi — ideally that staff use the company VPN on untrusted networks, so their traffic is encrypted before it leaves the laptop. The restaurant industry guide on this site covers the wider picture — see the cybersecurity for restaurants guide for how a small business layers firewalls with the rest of its defences.

For a business with a website, the server side matters too. Most hosting providers run a firewall in front of your site, and many offer a web application firewall as an add-on. Ask your host which of the two you have, and whether the WAF is actually enabled — a surprising number of sites pay for one that was never switched on. The check is the same as at home: confirm it is on, confirm the defaults are sane, and do not assume that buying a product means it is active.

Sources

• McAfee — "What Is a Firewall and How Does It Work?" (updated 3 February 2026): firewall definition, where firewalls are used, the six type descriptions including WAF and FWaaS, hardware-vs-software trade-off. https://www.mcafee.com/learn/what-is-a-firewall/
• Okta — "Firewall: Definition, How They Work & Why You Need One" (updated 13 August 2026): inspect-decide-act, the ten types, the 95-percent-of-companies figure from eWeek, "no firewall is infallible". https://www.okta.com/identity-101/firewall/
• Microsoft Support — "What is a Firewall?": ports as doors, the security-guard analogy, home networks should allow very little inbound traffic, router as hardware firewall and computer as software firewall. https://support.microsoft.com/en-us/office/what-is-a-firewall-6870c88d-69b6-4db4-9cb1-0e4afa7a8603
• Cisco — "What Is a Firewall?": network security device separating trusted and untrusted networks, packet-filtering limits, NGFW features (deep packet inspection, application visibility, intrusion prevention, malware defence, URL filtering). https://www.cisco.com/site/us/en/learn/topics/security/what-is-a-firewall.html
• Teldat — "What is a Firewall? Definition and Types": traditional firewalls at OSI layers 3–4, NGFW adding layer 7, deep packet inspection, and user identity; firewall vs antivirus. https://www.teldat.com/glossary/what-is-a-firewall-fw-types/
• NETGEAR Support — "What is a firewall?": every home network should have a firewall; a firewall does not secure against every kind of attack, so a virus checker is still needed. https://kb.netgear.com/224/What-is-a-firewall
• Geek Rewind — "How to Turn On or off Microsoft Defender Firewall in Windows 11": Windows Security → Firewall & network protection → profile → toggle, greyed-out switch meaning group policy or third-party control. https://geekrewind.com/how-to-turn-on-or-off-microsoft-defender-firewall-in-windows-11/
• Help Desk Geek — "How to Configure Microsoft Defender Firewall in Windows 10 and 11": inbound blocked by default, outbound open unless a rule closes it; profiles (Domain, Private, Public) and the allow-an-app screen. https://helpdeskgeek.com/configure-microsoft-defender-firewall-windows-10-11/

Frequently asked questions

What is a firewall in simple terms?

A firewall is a security guard for your network. It stands between your devices and the internet, checks every piece of data that tries to enter or leave against a set of rules, and blocks anything that does not belong. Your router has one, and your computer has one too.

Do I need a firewall if I already have antivirus?

Yes. A firewall controls network traffic, while antivirus looks for malicious files already on your device. They guard different doors, and neither can do the other's job — run both, as NETGEAR and McAfee both advise.

How does a firewall work?

It follows three steps on every connection: inspect the traffic, decide whether it matches the allowed rules, and act by letting it through or blocking it. It reads packet details such as source and destination addresses, ports, and protocols, and newer firewalls also inspect the contents of packets.

What are the types of firewalls?

The five main types are packet filtering, stateful inspection, proxy (application-level), next-generation (NGFW), and cloud firewalls (FWaaS). Website owners also meet a sixth: the web application firewall (WAF), which protects a website from attacks aimed at the site itself.

How do I turn on the firewall in Windows 11?

Open the Windows Security app, click Firewall & network protection, select your active network profile (Private for home, Public for café Wi-Fi), and switch Microsoft Defender Firewall to On. If the switch is greyed out, a work policy or a third-party security suite is managing the firewall instead.