A firewall is a security system that monitors and controls network traffic entering or leaving a device or network according to defined security rules. It can block unauthorised connections while allowing legitimate traffic, reducing exposure to network-based attacks and unwanted communications. Firewalls can be implemented as software on individual devices, network hardware, cloud services or combinations of these technologies.
Key Takeaways
- A firewall controls network connections rather than simply scanning files for malware.
- Firewalls can filter both incoming and outgoing traffic.
- A personal firewall protects an individual computer or device, while a network firewall can protect multiple systems.
- Modern firewalls can use IP addresses, ports, connection state, applications and other traffic characteristics when deciding whether to allow or block communications.
- A firewall does not replace antivirus, anti-malware, phishing protection or secure software practices.
- Windows includes a built-in firewall, and some security products provide tools for managing or extending its protection.
- Malwarebytes Premium Security currently includes Windows Firewall Control for Windows 10 and 11, allowing users to manage the built-in Windows Firewall and its connection rules from the Malwarebytes application.
What Does a Firewall Do?
A firewall acts as a control point for network traffic. When a device or network attempts to communicate with another system, the firewall evaluates the connection against its rules and determines whether the traffic should be permitted or blocked.
NIST defines a firewall as a device or programme that controls the flow of network traffic between networks or hosts with different security requirements.
For example, a firewall can help prevent an unauthorised device on the internet from establishing a connection to a computer. It can also control outbound connections, which can be useful if a compromised application attempts to communicate with an external server.
The distinction between inbound and outbound protection matters:
- Inbound filtering controls connections attempting to reach your device or network.
- Outbound filtering controls connections originating from your device or network.
- Application rules can restrict network access for particular programmes.
- Port filtering can restrict communications using specific network ports.
- Connection-state inspection can determine whether packets belong to an established and permitted connection.
Firewalls therefore provide access control rather than simply identifying malicious files. CISA describes firewalls as tools for stopping unauthorised connections or permitting only limited communications between networks and devices.
How Does a Firewall Work?
A firewall applies rules to network traffic. The exact rules and inspection methods depend on the type of firewall and how it has been configured.
Packet filtering
Basic packet filtering examines characteristics such as source and destination IP addresses, protocols and ports. A rule might permit traffic to a particular service while blocking another type of connection.
This approach can be efficient, but basic packet filtering has limited visibility into what an application is actually doing.
Stateful inspection
Stateful firewalls track the state of network connections. Rather than evaluating every packet independently, they can determine whether traffic forms part of an existing, permitted connection.
This allows a firewall to distinguish between expected response traffic and unsolicited connection attempts.
Application-level filtering
Application firewalls can inspect traffic associated with particular applications or protocols. NIST defines an application firewall as a firewall that uses stateful protocol analysis to analyse network traffic for one or more applications.
Application-aware controls can provide more granular decisions than rules based solely on addresses and ports.
Host-based filtering
A host-based or personal firewall runs directly on a computer and controls that device’s incoming and outgoing network traffic.
This is particularly useful for laptops because the device may connect to different networks rather than remaining behind a single network perimeter.
What Types of Firewalls Are There?
Firewalls can be classified by where they operate and how they inspect traffic.
| Firewall type | Where it operates | Typical purpose |
|---|---|---|
| Personal firewall | Individual computer | Controls traffic to and from one device |
| Network firewall | Network boundary | Protects multiple devices or network segments |
| Hardware firewall | Dedicated appliance or network equipment | Filters traffic between networks |
| Software firewall | Operating system or security software | Provides host-level network controls |
| Application firewall | Application or network layer | Applies more detailed application-aware rules |
| Web Application Firewall (WAF) | In front of web applications | Helps protect web applications from malicious HTTP/S traffic |
A WAF is different from the firewall running on a typical home computer. NIST identifies a Web Application Firewall as a distinct technology used in the protection of web applications.
Firewall vs Antivirus: What Is the Difference?
A firewall and antivirus software protect against different classes of problems.
| Protection | Primary function |
|---|---|
| Firewall | Controls network connections |
| Antivirus | Detects and blocks malicious software |
| Anti-malware | Detects and removes malware and related threats |
| Phishing protection | Helps identify fraudulent websites and messages |
| VPN | Encrypts network traffic between your device and a VPN service and changes the apparent network location |
A firewall may block an unauthorised connection without knowing whether the underlying programme is malicious. Conversely, antivirus software can identify malicious code even when it is stored locally and has not yet attempted a network connection.
Using a firewall alongside malware protection therefore provides different layers of defence.
Modern security suites increasingly combine these functions. For example, Malwarebytes Premium Security includes malware, phishing, ransomware and exploit protection alongside Firewall Control. Malwarebytes describes Firewall Control as filtering network traffic to protect Windows devices from unauthorised access.
Does Windows Have a Firewall?
Yes. Windows includes Microsoft Defender Firewall, which provides built-in network traffic filtering.
This means Windows users do not necessarily need to purchase a separate third-party firewall simply to obtain basic firewall functionality.
The more important question is whether the existing firewall is enabled, correctly configured and appropriate for the user’s requirements.
Malwarebytes’ current Windows Firewall Control feature provides a graphical way to manage the built-in Windows Firewall from within Malwarebytes. It supports Windows 10 and Windows 11 and provides different filtering profiles as well as access to Windows Firewall’s advanced settings.
Users should be cautious when changing firewall rules. An excessively restrictive configuration can prevent legitimate applications and services from working, while an overly permissive configuration can reduce the protection provided by the firewall.
Do You Need Firewall Software?
Most users should have a firewall enabled, but that does not necessarily mean they need to purchase standalone firewall software.
For a Windows computer, the built-in firewall already provides core network filtering. The decision to purchase security software should therefore be based on the additional protection and management capabilities it provides rather than simply whether it contains the word “firewall”.
Consider paid security software when you also want capabilities such as:
- Real-time malware protection
- Ransomware protection
- Exploit protection
- Phishing and malicious-website protection
- Scam detection
- More convenient firewall management
- Additional privacy or identity-protection features
Malwarebytes Premium Security, for example, combines antivirus and anti-malware protection with web protection, ransomware protection, exploit protection and Windows Firewall Control. Its firewall feature is specifically designed to manage the Windows Firewall rather than simply requiring users to replace it with a separate firewall.
What Should You Look for in Firewall Software?
The most useful firewall capabilities depend on whether you are protecting a single computer, several devices or an entire network.
Inbound and outbound controls
A capable firewall should provide appropriate control over both incoming and outgoing connections. Outbound controls can be particularly useful when an already-compromised device attempts to communicate with an external system.
CISA notes that limiting both inbound and outbound communications can reduce attack vectors and, in some circumstances, help contain a compromised host.
Application control
Application-level rules can provide more useful control than simply blocking individual ports. They can allow or restrict network access for specific applications and services.
Logging and visibility
Logs can show which connections have been permitted or blocked. This information can help diagnose connectivity problems and identify unexpected network activity.
Ease of configuration
A firewall that requires complex manual configuration may be inappropriate for a typical home user. Good security software should provide sensible defaults while allowing more advanced users to adjust rules when necessary.
Compatibility
Check the supported operating systems before purchasing. Firewall capabilities can differ substantially between Windows, macOS, Android and iOS. A product may also use the operating system’s built-in firewall rather than supplying its own network-filtering engine.
Can a Firewall Stop Viruses?
A firewall can help prevent some malware-related attacks, but it cannot stop every virus or malware infection.
For example, a firewall may prevent an unauthorised network connection while malicious software could still arrive through a legitimate download, infected document, removable storage device or compromised website.
Firewalls also cannot determine that every permitted connection is safe. A malicious programme may communicate over a connection that the firewall has been configured to allow.
This is why firewalls should be treated as one component of layered security rather than a replacement for antivirus and anti-malware protection.
Can a Firewall Protect You on Public Wi-Fi?
A device firewall can help control network connections when using public or otherwise untrusted networks.
This is particularly relevant for laptops because they can move between home networks, workplace networks, public Wi-Fi and mobile hotspots. A host-based firewall continues to operate on the device rather than relying solely on security controls at one particular network.
However, firewall protection does not encrypt all internet traffic. A VPN and properly secured application connections address different security requirements.
Firewall Security: Common Mistakes to Avoid
Turning the firewall off permanently
Disabling the firewall removes an important layer of network access control. If a legitimate application is being blocked, investigate the relevant rule or configuration instead of leaving the firewall disabled.
Allowing everything through
Overly broad rules can undermine the purpose of a firewall. CISA warns that overly permissive or nonexistent firewalls can create vulnerabilities by allowing unauthorised access.
Running incompatible firewall products together
Installing multiple products that attempt to control the same firewall functions can create conflicts or unexpected behaviour. Check the software provider’s compatibility guidance before replacing or adding firewall technology.
Assuming a firewall makes a device secure
A firewall does not automatically protect against phishing, stolen passwords, malicious files, software vulnerabilities or social engineering. Security updates, strong authentication, malware protection and cautious online behaviour remain important.
Is a Firewall Worth Having?
Yes. A properly configured firewall provides an important layer of network security by controlling which connections can reach or leave a device or network.
For most individual Windows users, the built-in Windows Firewall provides the basic firewall function without requiring a separate firewall purchase. The stronger reason to choose a security suite is the combination of firewall management with additional protection such as malware detection, ransomware defence, exploit protection and malicious-website blocking.
For users who want these additional layers in one application, Malwarebytes Premium Security is a relevant option because its current Windows offering combines broad device protection with controls for the built-in Windows Firewall.
Frequently Asked Questions
1. What is a firewall in simple terms?
A firewall is a security system that monitors network traffic and decides which connections should be allowed or blocked according to security rules. It can protect an individual device or an entire network.
2. Do I need a firewall if I have antivirus software?
Yes. Antivirus and firewall technologies address different risks. Antivirus software focuses primarily on detecting and blocking malicious software, while a firewall controls network connections. Using both can provide broader protection.
3. Is the Windows Firewall good enough?
For many Windows users, the built-in Windows Firewall provides the core network-filtering functionality they need. Additional security software may still be useful if you require broader malware, phishing, ransomware or exploit protection, or easier management of firewall settings.
4. Does a firewall protect against hackers?
A firewall can reduce exposure to unauthorised network connections and certain types of network attacks, but it cannot prevent every form of hacking. Attackers can exploit vulnerabilities, stolen credentials, malicious files and legitimate services that a firewall may not block.
5. What is the difference between a firewall and a VPN?
A firewall controls whether network connections are allowed or blocked. A VPN creates an encrypted connection between your device and a VPN service and can hide your normal IP address from websites and other internet services. They perform different security functions and can be used together.