What a firewall does, and why you mostly don't need to think about yours

A firewall is a filter that sits between your device or network and the rest of the internet, deciding which network connections to allow and which to block, based on rules about direction, port, and application. Its core job is rejecting unsolicited inbound traffic — connection attempts nobody inside asked for — which is what made worms of the early-2000s era largely extinct on home networks. For most people the practical advice is short: the firewalls built into Windows, macOS, and your router are on by default and already do this job; leave them on, and spend your worry on passwords and phishing instead.

How does a firewall actually work?

Network conversations are made of packets addressed to numbered ports. A stateful firewall — the standard kind since the 1990s — tracks which connections were initiated from inside: when your laptop requests a web page, the firewall remembers the conversation and lets the reply back in; when a stranger's scanner probes a port you never used, the packet is unsolicited and dropped. Rules layer on top of that reflex: block this port, allow this application, restrict this service to the office subnet. The distinction that matters most is direction — inbound filtering (blocking strangers) versus outbound filtering (controlling what installed software may contact) — because nearly all home-value lives in the first, while the second is where enterprise nuance begins.

What are the types?

• Host firewall — software on your own device: Windows Defender Firewall, the macOS application firewall, Linux distributions' netfilter. It filters per machine, including on coffee-shop Wi-Fi, and can control which applications accept connections.
• Router firewall / NAT — your home router performs network address translation, which by design drops unsolicited inbound connections for everything behind it. This accidental architecture is why home machines are not scanned directly from the internet.
• Hardware and next-gen firewalls — dedicated appliances for organizations, adding deep packet inspection, application awareness, user identity, and threat feeds to the same allow/block core.
• Web application firewalls — a different animal entirely: filters sitting in front of web servers, inspecting HTTP for attack patterns.

Is my firewall already on?

Almost certainly. Windows has enabled its firewall by default for years (check: Windows Security > Firewall & network protection — all profiles should be green). macOS's application firewall defaults on for services but worth verifying (System Settings > Network > Firewall). Your router's protection needs no action unless you have deliberately placed a machine in its DMZ or forwarded ports — those settings override the default protection and deserve a second look if you do not remember why they exist. The main real-world causes of a home machine being directly reachable: port-forwarding rules added years ago for a game server, UPnP openings installed silently, or "public" network profile misconfigurations on Windows.

When do people actually need to do something?

A short list:

1. After forwarding ports for gaming servers, cameras, or NAS access — verify each rule still serves a living purpose, and prefer VPN access to exposed services.
2. When hosting anything at home — a home server reachable from outside means a deliberate, minimal hole, with the service patched and authenticated, not a DMZ entry.
3. On public Wi-Fi — confirm the OS treats the network as public (it filters harder), which modern OSes do automatically.
4. For small businesses — segmenting the office network so the point-of-sale system, cameras, and staff devices cannot each reach the others; a managed firewall or business router makes those internal rules practical.

What does a firewall not stop?

Nearly everything in the modern threat picture. A firewall does not inspect the content of allowed traffic, so phishing pages, malicious downloads, and infostealers riding normal web connections pass straight through — connections your browser legitimately requested. It does not stop malware that uses allowed outbound channels, which is why outbound filtering is a weak home defense: the malware uses the same ports as your browser. It does not fix passwords, patch software, or judge attachments. The firewall's era-defining win — killing indiscriminate network worms — is real but completed; today it is one quiet layer in a stack whose active fronts are identity and phishing.

Should you buy a firewall?

Home users: no — what ships with your OS and router is appropriate, and third-party "firewall" consumer products mostly resell filtering you already have. Small businesses may justify a business-grade router for segmentation and content filtering. Tinkerers get real value from building one (pfSense, OPNsense on suitable hardware), provided they treat it as a hobby with security benefits rather than a necessity. For everyone else, the best firewall decision is the absence of one: verify the built-ins are on, remove stale port-forwarding, and move on to the threats that actually arrive by email.