The term appears everywhere: router settings, Windows panels, and nearly every piece of security advice. Yet what it actually does is rarely explained beyond the "wall of fire" metaphor.
That metaphor misleads. A firewall isn't a wall holding everything back, it's closer to a doorkeeper checking one simple question.
The one question it asks
Every connection passing through is checked: who started it?
When you open a website, the connection starts from inside. The firewall notes it, then allows that site's reply back in, because that reply is expected.
When something tries to reach your device from the internet without you ever asking, no note matches. That connection is dropped.
It's that simple, and that's precisely where its strength lies. Most automated scanning on the internet works by knocking on doors one at a time, and a firewall leaves every knock unanswered.
Two firewalls you already have
| Router firewall | Operating system firewall | |
|---|---|---|
| Guards | The boundary between home and internet | One device |
| Stops | Connections from outside | Connections from outside and from other devices at home |
| Protects | Every device at once | Only that device |
| By default | On | On |
A question that comes up often: if the router already guards the boundary, why does the computer need one too?
Because they guard different places. The router's firewall sees nothing of what happens inside the house. If one device on your network is compromised, a guest's laptop, a security camera running old firmware, or a smart television, it sits on the inside, and the router doesn't hold it back.
Your computer's firewall does. Which is why switching off the Windows firewall "so the printer gets detected" is a more expensive trade than it looks.
Protection that happens by accident
There's one more layer that works without being called a firewall, and many people don't realise it exists.
Devices in your home use local addresses that aren't routed on the internet. The router translates them through a process called NAT, and the side effect is this: from outside, your devices have no address that can be dialled. Not refused, there simply is no address to dial. How it works is explained in the guide to local IPs and DHCP.
This changes with IPv6. Under IPv6, every device gets a directly reachable address, so that accidental barrier disappears. What remains is the router's actual firewall, which is precisely why making sure it's on matters more. Discussed in the guide to whether to enable IPv6.
The holes you make yourself
A firewall only stops what wasn't asked for. A few things deliberately open doors, and those are worth knowing about:
- Port forwarding. You tell the router: connections on this port go to that device. The door stays open permanently, and automated scanners find it within hours, the port forwarding guide.
- UPnP. A feature letting devices open their own ports without asking. Convenient for games consoles, but it means any device on your network can punch a hole in the firewall without your knowledge.
- DMZ. Forwards every inbound connection to one device. This effectively turns the firewall off for that device, and is almost never the right answer.
All three live in the router panel, and all three are worth checking once, the guide to securing a home router.
What a firewall does not do
This is the part that most often creates false confidence.
It doesn't inspect contents. A firewall governs connections; it doesn't judge what travels through them. A malicious file you download yourself arrives over a connection you started, and the firewall is right to allow it. That's antivirus work.
It doesn't stop fraud. A fake page asking for your password is reached over an ordinary connection you started yourself. Nothing about it looks suspicious from the firewall's point of view.
It doesn't protect you on someone else's network. When you use café Wi-Fi, your home router's firewall doesn't come along. What remains is the firewall on your device, the guide to using public Wi-Fi safely.
It doesn't hide what you visit. The names of sites you open remain visible to your provider through DNS requests, the guide to public DNS and privacy.
Checking your own
Router firewall
Open the router panel and find the Firewall, Security, or WAN menu. What you're looking for: inbound connection blocking, switched on. It nearly always already is, just confirm nobody ever turned it off.
Turn off UPnP if you don't need it
Some games consoles require it. If you don't use one, turning UPnP off closes a route that other devices can use without your knowledge.
Windows firewall
Settings › Privacy & security › Windows Security › Firewall. All three profiles, domain, private, public, should be on.
macOS firewall
System Settings › Network › Firewall. Worth knowing: on macOS this isn't always on by default.
For business premises
In a café, clinic, or small office, the router's built-in firewall remains the first layer, but there's a problem it doesn't answer: devices inside the network seeing each other.
A visitor connected to the guest Wi-Fi sits on the inside, just like the point-of-sale computer. The router's firewall doesn't stop traffic between them. What does is network separation, a different problem, covered in the guide to separating a guest network.
The simple rule: a firewall guards the boundary between inside and outside. To guard boundaries inside, what you need is to divide the network, the guide to what a VLAN is.
In short
A firewall refuses connections you didn't ask for. That's one job, done well, and it has been running in both your router and your operating system since day one.
All you need to do is make sure nobody turned it off, and avoid opening holes without a clear reason. Beyond that, it works without needing attention.
