What is a Firewall?
Firewalls, told as a story about a wall with many doors and the gatekeeper who holds the door list.
The wall has more than one door.A guest door, a mail door, a storage door, an admin door… each has a number. That's a port.
With every door open, there's no wall at all.Thieves look for the back door nobody watches — an open port — first.
A firewall is the gatekeeper who opens and shuts doors by a list.'Guest door: anyone. Mail door: post office only. The rest: closed.' Not on the list, not open.
Someone I sent out gets let back in.'That's the one who went out' — it remembers who left. Strangers stay out.
It can't stop what comes through an open door, and it never looks inside.A bad note through the guest door goes unnoticed — that's the note checker's job. Inside the walls nobody is checked — that's the castle that always asks.
A firewall = the wall, plus the gatekeeper who opens and shuts each door by a list of who may use which door. Unlisted doors stay shut.
The oldest guard of all, around since the 1990s. Today's walls also carry the poster-watcher (IPS) and seal-breaking, and get called next-gen firewalls. iptables, pfSense, Palo Alto, Fortinet.
When grown-ups say it
- Port
- The door number. 443 is the guest door, 25 the mail door, 22 the admin door.
- IP address
- Where from. The messenger's home address. → the footprint
- Rule
- One line of the list. "Post office through the mail door → allow."
- Default deny
- Unlisted doors stay shut. Open only what's listed. The other way round is the castle with every door open.
- Stateful
- Remembering who went out. Replies get in; strangers don't.
- Packet
- The messenger. A little person carrying one note. The gatekeeper reads only the envelope.
- Next-gen firewall
- A wall with the poster-watcher inside. Adds wanted posters and seal-breaking — a peek past the envelope.
- Internal / segmentation firewall
- A wall inside the hallway. Splits the hallway inside too. → the hallway watcher