---
title: What is a Firewall?
description: A firewall is the gatekeeper that decides which network traffic gets through and which gets blocked. Here's what firewalls do, the main types, and the gotcha they create for monitoring.
canonical: https://watchfor.io/blog/what-is-a-firewall
---

[All posts](/blog) [Security](/blog/category/security) Dec 28, 2025 · 3 min read · WatchFor Team

# What is a Firewall?

A firewall is the gatekeeper that decides which network traffic gets through and which gets blocked. Here's what firewalls do, the main types, and the gotcha they create for monitoring.

Every connected system needs a bouncer — something deciding which traffic is welcome and which gets turned away at the door. That bouncer is a firewall , one of the oldest and most fundamental pieces of network security. Here's what it actually does, and a gotcha worth knowing.

## What a firewall is

A firewall controls network traffic based on a set of rules , allowing or blocking connections by criteria like source, destination, [port](/blog/what-is-a-network-port), and protocol. Its default stance is usually "deny," and you open up only what's needed.

Trusted traffic ──► [ Firewall: allow? ] ──► your service
Everything else ──► [ blocked ]

The goal: shrink your attack surface so only the traffic you intend can reach your systems.

## How it decides

A firewall checks each connection against its rules:

Criterion Example rule

Port Allow 443 (HTTPS), block everything else

Source IP Allow your office; block a known-bad range

Direction Allow inbound web, restrict outbound

Protocol Allow TCP on these ports, deny the rest

The classic setup: open the few ports your service needs (like 443), and deny the rest by default.

## The main types

Type What it filters

Network firewall Traffic by IP/port/protocol (the classic)

[WAF](/blog/waf-explained) Web application attacks (injection, bots) at the HTTP layer

Host firewall Traffic on a single machine

Cloud security group Cloud-provider rules around your instances

A network firewall works at the connection level; a [Web Application Firewall](/blog/waf-explained) works higher up, inspecting HTTP for application attacks. Most setups use both.

## Allow vs deny: two failure modes

Firewalls fail in two opposite ways:

- Too open — you left ports/sources exposed, widening your attack surface.

- Too closed — a rule blocks legitimate traffic you actually wanted, causing mysterious "[connection refused](/blog/connection-refused)" or timeouts.

That second one is the everyday operational headache: a firewall rule silently blocking a service, a partner, or — importantly — your monitoring.

## The monitoring gotcha

Here's the practical catch for anyone running checks:

A firewall can block your monitoring and create false "down" alerts. If your checks come from external [probe locations](/docs/reference/probe-locations) and your firewall doesn't allow them, the monitor sees a refused/timed-out connection — even though real users are fine. The fix: allowlist your monitoring's IP ranges.

It cuts the other way too: a firewall change can be the actual cause of an outage (you blocked something you needed), which external monitoring will catch the instant it happens.

## The bottom line

In one line

What A gatekeeper that allows/blocks traffic by rules.

Goal Shrink the attack surface — deny by default.

Types Network, WAF, host, cloud security groups.

Gotcha Can block legit traffic — including your monitors (allowlist them).

A firewall is the front-line "who gets in" decision for your systems. Configure it tight, but watch the two failure modes — too open is a security risk, too closed breaks legitimate traffic (sometimes your own checks).

Related: [WAF explained](/blog/waf-explained), [connection refused](/blog/connection-refused), [probe locations](/docs/reference/probe-locations).

[#security](/blog/tag/security)[#networking](/blog/tag/networking)[#basics](/blog/tag/basics)

## Start monitoring your services today

WatchFor checks HTTP, DNS, SSL, ping, email and 20+ more — from around the world, with alerts to Slack, Discord, email and beyond.

[Learn more](/docs/monitors)[Start free](/auth/sign-up)

Share this article

---

Canonical page: https://watchfor.io/blog/what-is-a-firewall · Site guide: https://watchfor.io/llms.txt