A firewall is a security barrier between a network you trust — your home or business network — and one you don’t: the internet. The name comes from building construction, where a firewall is a special wall that slows or stops a fire from spreading. A network firewall does the same job for unwanted traffic, keeping it from reaching your computers and devices.
How a firewall works
A firewall checks the traffic passing through it against a set of rules and decides whether to let it through or block it. A well-set-up firewall follows a simple principle: allow what’s needed and block everything else. Firewalls use a few main techniques, and most modern ones combine them:
- Packet filtering looks at where traffic is coming from, where it’s going, and which service (or “port”) it’s for, and allows or blocks it based on those details. It’s simple and fast.
- Stateful inspection keeps track of each connection. When your computer requests a web page, the reply is let back in because it matches a conversation your computer started; unrequested traffic from the internet is turned away. Almost every firewall today, including the one in your home router, works this way.
- Application-level filtering looks inside the traffic itself — which website or program it belongs to and what it contains — so it can block dangerous downloads, known malicious websites or particular apps.
Types of firewalls
- Software firewalls run on each computer. Windows, macOS and Linux all include one. They can control which programs on the computer are allowed to communicate, and they protect a laptop wherever it goes — including on hotel and coffee-shop Wi-Fi.
- Router firewalls are built into the router that connects your home or office to the internet, including most routers supplied by internet providers. They protect every device on the network by blocking unrequested traffic from the internet.
- Business firewalls are dedicated devices or services that add more protection, such as blocking known malicious websites, detecting attacks in progress, controlling which applications staff can use, and providing secure remote access (a VPN) for people working away from the office. Many of these are now delivered as cloud services.
Do you need a firewall?
Yes. Any device that connects to the internet should be behind a firewall, and the best protection comes from two layers: the firewall in your router and the one on each computer. The good news is that you probably already have both — they just need to be turned on and kept up to date.
Quick self-check
- Windows: open Windows Security and choose Firewall & network protection. It should show the firewall is on for each network type. Windows turns it on by default, but some programs and old security suites switch it off.
- Mac: open System Settings → Network → Firewall. Apple ships Macs with the firewall turned off, so it’s worth switching on, especially on a laptop you take out of the house.
- Linux: it depends on the distribution — some turn the firewall on by default and some don’t. Check your distribution’s firewall settings.
- Your router: sign in to its settings page or app and confirm the firewall is enabled and the firmware is up to date. While you’re there, make sure the admin password isn’t the factory default and that remote administration (managing the router from the internet) is turned off unless you really need it.
- Open ports: check for “port forwarding” rules that open the network to the internet — for remote desktop, cameras or a game console, for example. Remove any you don’t need. Remote desktop in particular should never be opened directly to the internet; use a VPN instead.
Don’t forget the router
The router is your network’s front door, and an old one can be a weak spot. Manufacturers stop releasing security updates for routers after a number of years, and in 2025 the FBI warned that criminals were taking over these unsupported routers and using them to hide their own activity. If your router no longer receives firmware updates, replace it. If you’re not sure, look up the model on the manufacturer’s website; a router that’s seven or eight years old or more is often past its supported life.
Many routers also have a feature called UPnP, which lets devices open ports in the firewall by themselves. It’s convenient for some games and devices, but it also lets malware do the same. If you don’t need it, turn it off.
For businesses
- Use a business-grade firewall rather than a consumer router once you have more than a few computers, store customer data, or need staff to connect from outside the office.
- Keep it updated. Firewalls are a favorite target for attackers precisely because they face the internet, and manufacturers regularly release urgent security fixes for them. Apply updates promptly, and plan to replace a firewall when it reaches the end of its supported life.
- Separate your networks. Put guest Wi-Fi, and devices such as cameras, smart TVs and other internet-connected gadgets, on networks separate from the computers that hold your business data.
- Use a VPN for remote access, with two-step verification, rather than opening services such as remote desktop to the internet.
- Review the rules from time to time. Exceptions added for a one-off job are often forgotten and left open for years. Remove anything that’s no longer needed.
A firewall is one layer
A firewall blocks unwanted connections, but it can’t stop you from opening a malicious attachment or entering your password on a fake website. It works best alongside up-to-date software, antivirus protection, backups and a healthy suspicion of unexpected emails. For a look at how the pieces fit together, see How Much Security Do You Really Need?
Need a hand?
PSA can install an efficient and secure network, or tune your existing one — including replacing outdated routers. Call (707) 506-6802 or send us a message.