---
title: What is a Firewall?
description: A firewall is the gatekeeper that decides which network traffic gets through and which gets blocked. Here's what firewalls do, the main types, and the gotcha they create for monitoring.
canonical: https://watchfor.io/blog/what-is-a-firewall
---

# What is a Firewall?

2025-12-28 · WatchFor Team · Security · security, networking, basics

A firewall is the gatekeeper that decides which network traffic gets through and which gets blocked. Here's what firewalls do, the main types, and the gotcha they create for monitoring.

Every connected system needs a bouncer — something deciding which traffic is welcome and which gets turned away at the door. That bouncer is a **firewall**, one of the oldest and most fundamental pieces of network security. Here's what it actually does, and a gotcha worth knowing.

## What a firewall is

A **firewall** controls network traffic based on a set of **rules**, allowing or blocking connections by criteria like source, destination, [port](/blog/what-is-a-network-port), and protocol. Its default stance is usually "deny," and you open up only what's needed.

```
Trusted traffic ──► [ Firewall: allow? ] ──► your service
Everything else ──► [ blocked ]
```

The goal: shrink your **attack surface** so only the traffic you intend can reach your systems.

## How it decides

A firewall checks each connection against its rules:

| Criterion | Example rule |
| --- | --- |
| **Port** | Allow 443 (HTTPS), block everything else |
| **Source IP** | Allow your office; block a known-bad range |
| **Direction** | Allow inbound web, restrict outbound |
| **Protocol** | Allow TCP on these ports, deny the rest |

The classic setup: open the few ports your service needs (like 443), and deny the rest by default.

## The main types

| Type | What it filters |
| --- | --- |
| **Network firewall** | Traffic by IP/port/protocol (the classic) |
| **[WAF](/blog/waf-explained)** | Web application attacks (injection, bots) at the HTTP layer |
| **Host firewall** | Traffic on a single machine |
| **Cloud security group** | Cloud-provider rules around your instances |

A **network firewall** works at the connection level; a **[Web Application Firewall](/blog/waf-explained)** works higher up, inspecting HTTP for application attacks. Most setups use both.

## Allow vs deny: two failure modes

Firewalls fail in two opposite ways:

- **Too open** — you left ports/sources exposed, widening your attack surface.
- **Too closed** — a rule blocks legitimate traffic you actually wanted, causing mysterious "[connection refused](/blog/connection-refused)" or timeouts.

That second one is the everyday operational headache: a firewall rule silently blocking a service, a partner, or — importantly — your monitoring.

## The monitoring gotcha

Here's the practical catch for anyone running checks:

> **A firewall can block your *monitoring* and create false "down" alerts.** If your checks come from external [probe locations](/docs/reference/probe-locations) and your firewall doesn't allow them, the monitor sees a refused/timed-out connection — even though real users are fine. The fix: **allowlist** your monitoring's IP ranges.

It cuts the other way too: a firewall change can be the *actual* cause of an outage (you blocked something you needed), which external monitoring will catch the instant it happens.

## The bottom line

| | In one line |
| --- | --- |
| **What** | A gatekeeper that allows/blocks traffic by rules. |
| **Goal** | Shrink the attack surface — deny by default. |
| **Types** | Network, WAF, host, cloud security groups. |
| **Gotcha** | Can block legit traffic — including your monitors (allowlist them). |

A firewall is the front-line "who gets in" decision for your systems. Configure it tight, but watch the two failure modes — too open is a security risk, too closed breaks legitimate traffic (sometimes your own checks).

Related: [WAF explained](/blog/waf-explained), [connection refused](/blog/connection-refused), [probe locations](/docs/reference/probe-locations).

---

Canonical page: https://watchfor.io/blog/what-is-a-firewall · All articles: https://watchfor.io/blog/all.md · Site guide: https://watchfor.io/llms.txt