Firewalls

A firewall is a security tool that monitors incoming and outgoing network traffic and blocks any traffic that is not allowed by its rules. It acts as a barrier between a network and the internet, or between one part of a network and another, so messages have to pass through it and be checked.

How the rules work

A firewall holds a list of rules, and each rule can allow or block traffic. Rules usually work in one of three ways:

• By address — allow traffic to and from known, trusted addresses and refuse anything else.
• By port — open only the ports a service actually needs, such as port 443 for secure web pages, and close the rest.
• By protocol — permit the types of traffic the network uses and refuse the rest.

For example, a school network might allow outgoing web traffic on the secure web port but block every incoming connection except to its own web server. Traffic that matches no allow rule is dropped.

Stopping a denial-of-service attack

During a denial-of-service attack, huge numbers of requests are sent from particular addresses to overwhelm a service. If the firewall is told to block traffic from those addresses, the flood is refused before it reaches the server, which helps keep the service available for genuine users.

What a firewall cannot do

A firewall filters traffic; it does not detect or remove malware. A virus inside a file that arrives on an allowed port passes straight through, which is why other security software is still needed. A firewall is also not a defence against SQL injection on its own, because the malicious command is hidden inside an ordinary web request that is allowed by the rules. A firewall is one of several prevention methods, so it is used alongside other safeguards.