Firewalls & Network Security

A firewall inspects network traffic and blocks or allows it based on rules, e.g. "allow web traffic on port 443, block everything else."

Example: what a firewall stops, and what it doesn't

A firewall correctly blocks an unsolicited connection attempt from a random unknown IP address on an unused port, traffic that clearly shouldn't be reaching this server at all. It does not stop an attack that looks like legitimate traffic on an allowed port (a compromised web application receiving a malicious but well-formed HTTP request), and it does not stop an attacker who's already gotten in through a phished employee's own valid credentials, that traffic looks completely normal from the firewall's point of view.

This is why real network security layers several defenses rather than relying on any single one, a firewall is a genuinely useful first line of defense, not a complete one on its own.