What Does a Firewall Do? Home & Business Guide
What a firewall actually does
Every piece of network traffic arrives at a door: an IP address and a port number. A firewall holds a list of rules about which doors may be knocked on and by whom. Traffic that matches an allowed rule passes; everything else is dropped silently.
Why does that matter? Because every service running on your machine, file sharing, remote desktop, a database, a camera’s admin page, listens on a port. Without a firewall, anyone on the network (or the internet, if your router forwards ports) can try those doors. Attack tools like Shodan exist because thousands of businesses and homes expose services that should never have been reachable from the internet.
| Firewall you already have | Where it sits | What it protects against |
|---|---|---|
| Router firewall (NAT + SPI) | Your router | Unsolicited connections from the internet to your devices |
| Windows Defender Firewall / macOS firewall | Your computer | Unwanted connections from other devices, including inside your network |
| Browser sandbox (a cousin) | Your browser | Web pages reaching parts of your system they shouldn’t |
The router firewall: your outer wall
Consumer routers provide protection mostly through NAT (network address translation): devices on the internet can only reach your router, not the computers behind it, unless a port-forwarding rule says otherwise. This is why your laptop isn’t constantly under attack from the internet at large.
It fails in two common ways. First, port forwarding: every rule you add punches a permanent hole, whether or not you still need it (old rules for a CCTV app you stopped using two years ago are a classic). Second, UPnP, covered in our router hardening guide, which lets any program punch its own holes without telling you.
Check your forwards now: in the admin page, under “Port Forwarding” or “Virtual Servers”. Delete every rule you don’t actively use, and check them again when you change a device.
The computer firewall: your inner wall
Windows and macOS both ship with firewalls enabled, and the most common problem is that people turn them off to “fix” an app that couldn’t connect, then never turn them back on.
Windows Defender Firewall has three profiles: Domain, Private and Public. The Private profile allows things like file sharing between your own devices at home; the Public profile blocks nearly everything inbound. This ties directly to our public WiFi guide: the profile follows the network type you picked when joining, so a laptop that’s set to “Public” everywhere is a laptop that’s hard to attack from the coffee shop next door.
Leave it on. When an app needs a door, add a specific rule for that app rather than disabling the whole firewall.
1. Turning the computer firewall off to fix an app, then forgetting to re-enable it.
2. Forwarding port 3389 (Remote Desktop) or 22 (SSH) to the internet. Automated scanners find these within hours, and they are the entry point for a huge share of breaches. Use a VPN for remote access instead.
3. Leaving UPnP on for years.
4. Forwarding a camera or NAS admin page to the internet “just to check it from work”.
When you need something bigger
A single home router with sensible settings is plenty for a household. The picture changes when a network holds other people’s data: client records, payment systems, medical information. Then it’s worth a dedicated firewall appliance (pfSense and OPNsense are excellent open-source options) with separate network zones: staff machines on one, guest WiFi on another, cameras and security systems on a third, with rules about what may talk to what. That’s network segmentation, and our guest network guide covers the home version of it.
Firewalls are one layer among several. They stop unsolicited connections; they do nothing about a staff member clicking a link in a phishing email or about software you invited in. Updates, backups and awareness do that work, and for businesses holding client data, an IT audit shows exactly where the gaps are.
Frequently asked questions
Do I need a firewall if my router has one?
Yes, keep both. The router’s firewall blocks unsolicited traffic from the internet; your computer’s firewall also blocks unwanted connections from inside the network, which matters when a laptop joins a coffee shop WiFi or an infected device lands on your LAN. They protect different directions.
Is forwarding a port for my CCTV safe?
Forwarding a camera or recorder’s admin page to the internet is one of the most common ways small businesses get breached. If you need remote viewing, use the manufacturer’s app with updated firmware, or better, ask us to plan the access properly with VPN or isolated access. Never forward RDP (3389) or SSH (22) directly.
What’s the difference between a hardware and software firewall?
A hardware firewall (in your router or a dedicated appliance) protects the whole network at the gate. A software firewall (Windows or macOS) protects that one computer, even when the network itself is untrusted. Businesses handling client data benefit from both, properly configured.
Not sure what your firewall is letting through?
ARTRIBE Tech audits firewall rules, ports and remote access as part of a full IT audit, then fixes what needs fixing properly.
Book an IT audit →