6.1Filtering traffic with a firewall

In network support, a frequent report is "only a specific service will not connect." One cause is filtering by a firewall placed at the traffic boundary. A firewall is a checkpoint that decides by rules which traffic to pass (permit) and which to stop (deny), hardening defenses with a default-deny posture of blocking by default and opening only what is needed. This section covers a firewall's basic behavior, typical ports/protocols that are commonly blocked, and the stateful mechanism that remembers the state of a connection—through the lens of isolating "whether the filter is the reason traffic will not arrive."

6.1.1A firewall's role and rules

• A firewall is a device or software placed at the boundary between networks of different trust (e.g., between an internal LAN and the internet) that screens passing traffic by rules. By deciding "pass or stop," it limits unauthorized access from outside and unnecessary traffic from inside.
• The instruction to pass traffic is permit, and to stop it is deny. Rules mainly decide by source/destination IP address and port number/protocol (e.g., TCP 443, UDP 53). A set of rules is a list, line by line, of what to pass or stop when a condition matches.
• The basic stance is default deny—"stop everything except what is explicitly permitted." Open only the needed services (e.g., HTTPS for web browsing) with permit rules and keep the rest closed by default, reducing open holes.