How does a firewall work

Guarding the doors

In the networking area we saw that traffic passes through numbered doors called ports. Doors are divided by use, such as one for the web and one for mail. Leaving every door open is convenient, but then anyone can come in through any door and poke at the program running behind it.
So a guard is posted in front of the doors. This guard, which looks at each piece of traffic and decides whether to let it through or block it, is the firewall. It can stand at the entrance to a network, like the router in a home or office, and it can also live inside each individual computer.

Tap to send incoming traffic. The firewall stops it in the middle and checks it.

The traffic you sent did not go straight in; it stopped in front of the firewall. Not just letting things through, but stopping them first to check: that is the guard's first job. If everything got in without a check, there would be no point in having a guard.
What the guard looks at is closer to the envelope stuck on the traffic: where it came from, where it is going, and which numbered door it wants to enter. So looking at that envelope, what rule decides between passing and blocking?

Rules decide allow and block

The guard holds a list of rules. The rules write down which traffic to allow and which to block. A web server, for example, might keep its web door open and keep other unused doors closed. Rules can also include source or destination addresses, so that only traffic from certain places is accepted.
When traffic arrives, the guard checks the rules from the top down and follows the first one that matches. So even with the same rules, the order they are in can change the result. It sounds complicated, but the core is simple: pair doors with rules to separate passing from blocking.

Tap allow or block for each door to set the rules. Traffic passes or is blocked just as you set.

Once the rules were set, the results split clearly. Traffic went straight through doors set to allow and was stopped at doors set to block. The same traffic met a different fate depending on which door it came to and what that door's rule was.
But a question comes up here. To view a website, the site's response has to come in, so what happens if incoming traffic is blocked? Modern firewalls remember connections started from the inside and let in only the responses to those connections. Then how should traffic that matches no rule at all be handled?

The default: block what you do not know

Say an unfamiliar piece of traffic arrives that no rule covers. The guard can take one of two stances. One is default allow: let things in first and block only what looks suspicious. The other is default deny: block first and let in only what has been allowed.
The safer one is default deny. Under default allow, forgetting even one thing that should be blocked leaves a hole, but under default deny, a door you forgot to put on the allow list simply stays closed. Mistakes, in other words, fall on the closed side rather than the open side.

Tap to switch the default stance. With default deny, all unfamiliar traffic not on the allow list is blocked.

Switching the stance made a big difference. Under default allow, unfamiliar traffic slipped in too, but after switching to default deny, only what was on the allow list passed and everything else was blocked. Automatically closing off even traffic you never thought of is the strength of default deny.
It does have a cost: each time a new program needs a door, an allow rule has to be added for it. Still, that hassle is far cheaper than a hole you do not know about. So are fewer open doors safer?

Fewer open doors are safer

All the points that can be reached from outside, taken together, are called the attack surface. Each open door is one such point, and behind each door a program is running. If that program has a flaw nobody has found yet, the door can become a way in.
So the more doors are open, the wider the attack surface, and keeping only the doors you need while closing the rest narrows it. There is no reason to leave doors open that you do not even use. Just closing unused doors cuts exposure a lot, and a small surface is also easier to defend.

Tap the open doors one by one to close them. The fewer open doors, the shorter the attack surface bar.

Each time a door closed, the attack surface bar got shorter. With many doors open the exposure was wide, and leaving only the doors you need cut it sharply. That is exactly what reducing the attack surface means.
Of course, closing doors you need would stop your work, so the ones you use must stay open. And a firewall cannot stop what comes in through a door it allows. A malicious file that arrives through the web door, or a link that someone inside opens themselves, is traffic the rules permit. Open what you use and close what you do not, but remember that doors alone cannot protect everything.

Wrapping up

Put together, it goes like this. A firewall is a guard that checks traffic going in and out against rules. Traffic passes through doors called ports, and the firewall checks the source, the destination, and the door number against rules that say whether to allow or block. It remembers connections started from the inside and lets their responses in.
The default is default deny, blocking what it does not know, so only what has been allowed passes. The fewer open doors, the narrower the attack surface and the safer it is. What comes in through allowed doors, and what a person opens themselves, is not the firewall's job.

Tap the four key points in order to review: guarding the doors, allow and block rules, blocking by default, and reducing the attack surface.

Now you know what a firewall does. It is a guard that watches the doors, checks traffic by rules, blocks what it does not know, and closes doors that are not used. But this guard only looks at the envelope; it cannot stop a person inside from opening the door themselves.
So instead of breaking down the door, attackers sometimes trick people into opening it. Next lesson, we look at these attacks that target the human mind rather than technology: social engineering.