What is a Firewall?

Every connected system needs a bouncer — something deciding which traffic is welcome and which gets turned away at the door. That bouncer is a firewall, one of the oldest and most fundamental pieces of network security. Here's what it actually does, and a gotcha worth knowing.

What a firewall is

A firewall controls network traffic based on a set of rules, allowing or blocking connections by criteria like source, destination, port, and protocol. Its default stance is usually "deny," and you open up only what's needed.

Trusted traffic ──► [ Firewall: allow? ] ──► your service
Everything else ──► [ blocked ]

The goal: shrink your attack surface so only the traffic you intend can reach your systems.

How it decides

A firewall checks each connection against its rules:

Criterion	Example rule
Port	Allow 443 (HTTPS), block everything else
Source IP	Allow your office; block a known-bad range
Direction	Allow inbound web, restrict outbound
Protocol	Allow TCP on these ports, deny the rest

The classic setup: open the few ports your service needs (like 443), and deny the rest by default.

The main types

Type	What it filters
Network firewall	Traffic by IP/port/protocol (the classic)
WAF	Web application attacks (injection, bots) at the HTTP layer
Host firewall	Traffic on a single machine
Cloud security group	Cloud-provider rules around your instances

A network firewall works at the connection level; a Web Application Firewall works higher up, inspecting HTTP for application attacks. Most setups use both.

Allow vs deny: two failure modes

Firewalls fail in two opposite ways:

Too open — you left ports/sources exposed, widening your attack surface.
Too closed — a rule blocks legitimate traffic you actually wanted, causing mysterious "connection refused" or timeouts.

That second one is the everyday operational headache: a firewall rule silently blocking a service, a partner, or — importantly — your monitoring.

The monitoring gotcha

Here's the practical catch for anyone running checks:

A firewall can block your monitoring and create false "down" alerts. If your checks come from external probe locations and your firewall doesn't allow them, the monitor sees a refused/timed-out connection — even though real users are fine. The fix: allowlist your monitoring's IP ranges.

It cuts the other way too: a firewall change can be the actual cause of an outage (you blocked something you needed), which external monitoring will catch the instant it happens.

The bottom line

	In one line
What	A gatekeeper that allows/blocks traffic by rules.
Goal	Shrink the attack surface — deny by default.
Types	Network, WAF, host, cloud security groups.
Gotcha	Can block legit traffic — including your monitors (allowlist them).

A firewall is the front-line "who gets in" decision for your systems. Configure it tight, but watch the two failure modes — too open is a security risk, too closed breaks legitimate traffic (sometimes your own checks).