What it is and the problem it solves
A firewall is a network security system that enforces traffic rules at boundaries. It solves the problem of uncontrolled data flow between networks of differing trust levels — such as the Internet and a corporate LAN, or between VLANs.
How it works
A firewall monitors and controls network traffic using configurable security rules. It inspects packets by source and destination IP addresses, protocol, and source or destination ports. It applies actions via an access-control list: silent discard, discard with ICMP or TCP reset, or forward to the next hop. Packet filtering is the first reported type of network firewall.
What works
Packet filtering works reliably at layer 3 and 4. It scales to high throughput. It operates deterministically with minimal latency. Silent discard prevents information leakage. Access-control lists are human-readable and auditable.
What does not
It does not inspect packet content beyond headers. It does not decrypt traffic. It does not detect malware, zero-day exploits, or lateral movement inside a trusted network. It cannot enforce policy based on user identity or application context unless augmented.
What it changes
It changes network architecture from flat to segmented. It forces explicit decisions about inter-zone traffic. It shifts responsibility for access control from endpoints to perimeter points — a model now strained by cloud, mobility, and encrypted traffic.
Is it worth your time
Yes — if you manage network boundaries between trusted and untrusted zones. It requires ongoing rule maintenance and offers no protection against encrypted payloads or application-layer attacks. Its value lies in deterministic, low-overhead traffic control — not detection or adaptation.
