A firewall is a security system that monitors and controls the traffic flowing in and out of a computer network, allowing safe data through and blocking anything that looks dangerous. The term gets thrown around constantly in tech circles, but most people have only a rough sense of what a firewall actually does. Whether you're a home user, a small business owner, or just someone who wants to understand the basics of digital security, knowing how firewalls work gives you a clearer picture of how your data stays safe online.
What a firewall actually does
Think of a firewall as a security guard at the entrance to a building. Every piece of data that travels across a network is broken into small units called packets. A firewall inspects those packets and checks them against a set of rules. Packets that meet the rules get through. Packets that don't get dropped.
The rules can be simple or complex. A basic firewall might block all traffic from a specific country. A more advanced one might inspect the contents of packets in real time and look for patterns that match known attack signatures. The fundamental principle is the same: decide what's allowed, stop everything else.
Firewalls sit between your trusted internal network (your home Wi-Fi, your office computers) and an untrusted external network (the internet). They don't just block incoming threats. A well-configured firewall also monitors outgoing traffic, which matters if malware inside your network tries to contact an external server.
The main types of firewalls
Not all firewalls work the same way. There are four broad categories you'll encounter.
- Packet-filtering firewalls: The oldest and simplest type. These check the header of each data packet, looking at the source address, destination address, and port number. They're fast but shallow. They don't look inside the packet itself.
- Stateful inspection firewalls: These track the state of active connections. Rather than treating each packet in isolation, a stateful firewall knows whether a packet is part of an established, approved connection. Far more effective than basic packet filtering.
- Application-layer firewalls (proxy firewalls): These operate at a deeper level, inspecting the actual content of traffic for specific applications like web browsers or email clients. They can detect threats that slip past lower-level filters.
- Next-generation firewalls (NGFW): The current standard for enterprise security. NGFWs combine stateful inspection with deep packet inspection, intrusion prevention, and threat intelligence feeds. Products like Palo Alto Networks' NGFW are widely deployed in Australian corporate environments.
Hardware firewalls vs software firewalls
Firewalls come in two physical forms, and most people use both without realising it.
A hardware firewall is a dedicated physical device that sits between your modem and your network. Your home router almost certainly has one built in. It protects every device on the network without needing to be installed on each individual computer. Businesses typically invest in standalone hardware firewall appliances that handle much heavier traffic loads.
A software firewall runs on an individual device. Windows includes one by default. MacOS does too. These protect the device they're installed on, but they don't see traffic between other devices on the same network. Software firewalls are the last layer of defence, not the first.
Running both is not redundant. It's standard practice. A hardware firewall filters threats at the network perimeter; a software firewall catches anything that slips through to a specific device.
What firewalls can and can't stop
Firewalls are powerful, but they're not magic. They block unauthorised connections and known malicious traffic patterns well. They don't stop threats that arrive through permitted channels.
Phishing emails, for example, often pass straight through a firewall because email is an allowed protocol. Malware hidden inside a legitimate-looking file download can do the same. A firewall also won't protect you from a weak password or an unpatched operating system. That's why firewalls work best as part of a broader approach to cybersecurity, not as a single solution.
Encrypted traffic presents another challenge. When data travels over HTTPS, a standard firewall can't inspect its contents without breaking the encryption. Next-generation firewalls can perform SSL inspection, which decrypts, inspects, and re-encrypts traffic, but that adds processing overhead and raises its own privacy considerations.
Do you need a firewall at home?
Yes. The short answer is that your home router already provides basic firewall protection, but most people never configure it properly. Default settings are often permissive. Changing your router's default admin password, disabling remote management, and making sure the built-in firewall is actually switched on are three steps that take under ten minutes and close several common attack vectors.
For Australians working from home, the stakes are higher. A home network that connects to an employer's systems becomes a potential entry point for attackers. Using a VPN alongside a properly configured firewall adds a meaningful layer of protection for remote workers handling sensitive data.
If you're running a small business from home or managing your own servers, a dedicated hardware firewall appliance is worth the investment. Consumer routers are not designed to handle the volume or sophistication of traffic a business generates.
Firewalls and two-factor authentication work together
A firewall secures the network perimeter. It does not secure individual accounts. An attacker who obtains valid login credentials can often walk straight past a firewall because the traffic looks legitimate. That's why two-factor authentication complements firewall protection directly: even if credentials are stolen, a second verification step blocks unauthorised access.
Layering these controls is how security professionals think about defence. No single tool covers every threat. A firewall, combined with strong authentication, encrypted connections, and regular software updates, forms the kind of multi-layered protection that makes opportunistic attackers look elsewhere.
Keeping your firewall effective
A firewall is not a set-and-forget device. Rules need reviewing. Firmware needs updating. For businesses, firewall logs need monitoring, because a log full of blocked connection attempts is useful threat intelligence, not noise to be ignored.
The Australian Cyber Security Centre recommends that organisations review firewall rules at least annually and remove rules that are no longer needed. Outdated rules accumulate over time and create unnecessary openings. Treat your firewall configuration the way you'd treat a legal contract: it should reflect current reality, not last year's assumptions.
Firewalls have been a cornerstone of network security since the late 1980s. The underlying principle hasn't changed. Only permitted traffic gets through. Everything about modern firewalls, from deep packet inspection to machine-learning-based threat detection, is an elaboration on that one idea.