A firewall protects a network by monitoring incoming and outgoing network traffic and applying predefined security rules. It permits legitimate communications while blocking unauthorized, suspicious, or unnecessary connections.
A firewall creates a controlled boundary between a trusted internal network and an untrusted network such as the internet. When traffic reaches this boundary, the firewall examines information such as the source and destination IP addresses, port numbers, protocol, and direction of transmission.
It then compares this information with its firewall rules. For example, a school might allow web traffic using ports 80 and 443 but block unsolicited external requests to internal devices. A default-deny policy blocks traffic unless a rule explicitly permits it, reducing the network's attack surface.
| Firewall technique | How it protects the network |
|---|---|
| Packet filtering | Examines packet headers and accepts or rejects packets according to rules involving addresses, ports, and protocols. |
| Stateful inspection | Records active connections and permits packets only when they belong to a valid, established session. |
| Application-layer filtering | Examines application-level data to identify prohibited services, content, or suspicious requests. |
| Outbound filtering | Restricts traffic leaving the network, which can limit data theft or communication between malware and an attacker. |
For example, if an external device sends a packet to a blocked administrative port, the firewall compares the packet header with its rules and rejects the packet. Depending on its configuration, it may also record the event in a security log, allowing administrators to identify repeated access attempts.
A common misconception is that a firewall makes a network completely secure. It does not necessarily stop malware delivered through permitted traffic, attacks by authorized users, or social engineering. It must therefore be combined with authentication, access controls, encryption, software updates, and anti-malware measures.
Exam technique: For an IB command term such as explain, do not write only that a firewall “blocks hackers.” Identify the traffic examined, describe the rules applied, and show how allowing or rejecting that traffic reduces unauthorized network access.
