What is a firewall, and do you already have one? The short answers: a filter for network traffic, and almost certainly yes. A firewall sits between your device and everything else, looks at each connection trying to cross, and either lets it through or stops it. That is the entire idea. The rest is detail about how closely it looks and who wrote the rules.
Most people have already met one without knowing. The little window that pops up the first time you run a game or a chat program, asking whether to allow it on your network, is a firewall asking you to write a rule.
A firewall checks every connection going into or out of your device and allows or blocks it based on a set of rules. Nothing more mysterious than that.
How a firewall makes its decision
Data does not travel across a network in one piece. It moves in packets, small chunks that each carry a label saying where they came from, where they are headed, and which port they want. A port is a numbered doorway on your machine, one for each kind of conversation: web pages usually arrive through port 443, email through its own, file sharing through another.
The firewall reads those labels and compares them to its rules. Allow this port, block that address, permit this program, refuse anything that nobody asked for. The check happens on every packet, all day.
Two directions matter, and they are treated very differently.
Almost every firewall a home user owns is strict about the first and relaxed about the second. It also has enough memory to tell the difference between a knock and a reply: when you open a web page, the answer coming back is expected, so it is waved through. That memory is what people mean by a stateful firewall.
Why a firewall matters
Any device with an internet connection receives unrequested connection attempts constantly. Not because someone chose you, but because automated scanners spend all day trying every address they can reach, looking for a machine that answers. A firewall is why yours stays quiet instead of answering.
That quiet matters in three practical situations.
The first is any shared network. On cafe, hotel, or airport wifi you are sitting on the same network as every other guest, and whatever protection your home router gives you is back at home. The firewall on the laptop itself is all that is left.
The second is your own home. If one machine in the house picks up something nasty, the firewalls on the other machines are what stop it walking sideways across the network to reach them.
The third is the direction almost nobody thinks about. A firewall that also watches outbound traffic can tell you that a program you installed last week talks to a server every ten minutes, and it can stop that conversation. Malware that gets in has to phone home to be useful, and outbound rules are where that call gets cut. The same list has a quieter use: reading which of your own programs ask for network access tends to change how you feel about a few of them.
It is just as important to know what a firewall does not do. It does not scan files for viruses. That is the antivirus engine’s job, and signature matching has its own blind spots. It does not stop you from installing something you should not have installed, because software you invited in is traffic you approved. It does not hide what you do from your internet provider, which is a different tool entirely. And it cannot tell a genuine login page from a convincing fake. A firewall controls connections. It does not exercise judgment on your behalf.
The types of firewalls, from simple to strict
The categories below are layers of thoroughness rather than competing products. Each one includes the ability of the one before it.
Cutting across those four are two distinctions worth knowing, because product descriptions use them constantly. A hardware firewall is a separate box guarding a whole network, and your router is one. A software firewall runs on the device itself and protects only that device. The first stops trouble at the gate of the property. The second stands at the door of the room, which is why owning both is not redundant.
The firewalls you already own
On Windows, the built-in firewall is on from the moment you install the system, and its default behavior is exactly the asymmetry described earlier: unrequested inbound traffic is blocked unless a rule allows it, while outbound traffic is allowed unless a rule prohibits it. You will find it in the Windows Security app under Firewall and network protection. Microsoft advises against deleting the rules that ship with it, since core parts of the system depend on them.
On a Mac, the picture is different in a way that surprises people. macOS carries an application firewall that blocks incoming connections unless you permit them, but it arrives switched off, on the reasoning that a Mac ships with nothing listening for outside connections in the first place. Switching it on takes one click in the system settings, and its options include stealth mode, which stops the machine replying to probes that are only trying to work out whether anything is there. Turning it on costs nothing and is worth doing before the next time you use a network you do not control.
Your router is a firewall too, though it rarely calls itself one. Because several devices in the house share a single public address, the router has to translate between them, and when an unrequested connection arrives from outside it has no idea which device to hand it to, so it discards it. That accident of design is what keeps every device in the house invisible from the outside. It also explains the limit: the router never sees traffic between two machines inside the house, and it does not care what your laptop sends outward.
Phones are the odd case. Neither Android nor iOS hands you a firewall you can open and edit. On Android, the apps that offer one work by taking over the VPN slot and filtering traffic as it passes through, which does the job but means only one such app runs at a time, so you choose between the filter and an actual VPN. On a phone, app permissions and being careful about what you install do the job a firewall does on a desktop.
Linux desktops sit somewhere in between: the filtering is built into the kernel and managed through front ends like UFW, which ships with Ubuntu but is not switched on for you.
Do you need a firewall if you already have antivirus?
They answer different questions. Antivirus asks whether a file or a running process is dangerous. A firewall asks whether a connection should exist. Neither answer covers the other, which is why security suites bundle both instead of choosing, and why picking a solid free antivirus is a separate decision from this one.
For most people, the firewall built into the system plus the one inside the router is genuinely enough, and the useful action today is simply confirming that both are switched on. A separate firewall program earns its place when you want the thing the built-in one will not give you: a live view of which programs are talking to the internet, and a straightforward way to tell one of them to stop. That is the gap the per-app firewall tools fill, and it is the reason people who care about privacy install one even on a machine that is already protected.
If that sounds like your situation, the firewall and network control tools in the Security and Privacy library are the place to start. Either way, there is a question worth sitting with tonight, and you can answer it in about a minute by opening the firewall you already have: of everything currently running on your machine, how many of those programs would you approve if you were asked about each one?
