Firewalls & Network Security

A firewall inspects network traffic and blocks or allows it based on rules — e.g. "allow web traffic on port 443, block everything else."

Example: what a firewall stops, and what it doesn't

A firewall correctly blocks an unsolicited connection attempt from a random unknown IP address on an unused port — traffic that clearly shouldn't be reaching this server at all. It does not stop an attack that looks like legitimate traffic on an allowed port (a compromised web application receiving a malicious but well-formed HTTP request), and it does not stop an attacker who's already gotten in through a phished employee's own valid credentials — that traffic looks completely normal from the firewall's point of view.

This is why real network security layers several defenses rather than relying on any single one — a firewall is a genuinely useful first line of defense, not a complete one on its own.