Lesson 1
What is a Firewall?
Every device on the internet gets a constant stream of traffic. Most of it is stuff you asked for, like web pages and email. Some of it isn't: scans, connection attempts to services you never meant to expose, and malicious downloads. Something has to stand at the border and decide what gets in. That something is a firewall.
▶ Watch the video first (about 9 minutes)
Video: "What is a Firewall? How It Protects Your Network!" by Neurix on YouTube.
Watch a firewall work
Every packet that tries to cross gets checked against the firewall's rules. Allowed packets pass through. Blocked packets get stopped at the wall. Switch to Outbound to see that a firewall also checks traffic leaving your network.
💂 The security guard
Picture a guard at the entrance of a building, holding a list. If you're on the list, you come in. If you're not, you're turned away. A firewall does the same thing for network traffic, thousands of times per second.
↔️ It works both ways
A firewall doesn't only watch traffic coming in. It can also control traffic going out. That helps stop a device inside your network from connecting somewhere it shouldn't, for example a PC that's already been infected trying to "phone home" to an attacker.
Two kinds of firewall
Hardware firewall
A dedicated device, usually at the edge of the network, that protects every device behind it.
Software firewall
A program running on one computer (like Windows Defender Firewall) that protects just that device.
✅ Quick check
Lesson 2
Ports & Traffic
A device can run many services at once: a website, email, remote access. Each one is reached through a numbered port. Think of ports as numbered doors into a device. The port number tells you what kind of traffic it is.
Well-known ports
| Port | Service | Used for |
|---|
What a firewall reads on every packet
Hover over each piece.
Where the packet is going.
Which door (service) it's aimed at.
How it travels: TCP or UDP.
Where it came from.
🚪 Lab: Lock down the server
Lesson 3
How Firewall Rules Work
A firewall holds a list of rules and reads them in order, top to bottom. When a packet arrives, it's compared against each rule one at a time. As soon as a rule matches, the firewall does what that rule says and stops checking. The first match wins.
The parts of a rule
Reads as: "Allow traffic from the Internet to the Web Server on port 443."
The most important rule: Deny All
A well-configured firewall ends with a final rule: Deny All. Anything that wasn't explicitly allowed gets blocked automatically. You can't list every bad thing on the internet, so you start closed and open only exactly what you need.
🧪 Rules Lab
| # | Action | From | To | Port |
|---|
➕ Add a rule (it's added just above Deny All)
📦 Send a test packet
Lesson 4
Packet Filtering vs Stateful
Not all firewalls are equally smart. A packet filter looks at each packet on its own and has no memory; every packet is a stranger. A stateful firewall remembers the conversations you started in a connection table, so it can tell a real reply from a fake one.
🔬 Lab: Spot the fake reply
Firewall rules
Connection (state) table
What happened
Lesson 5
Next-Generation Firewalls (NGFW)
A stateful firewall checks addresses, ports, and connections, but it mostly looks at the outside of each packet. Attackers know port 443 is almost always open, so they hide malicious content inside that "normal" web traffic. A next-generation firewall looks inside.
Inspects content
Looks at what's actually in the traffic, not just the address and port.
Identifies applications
Knows which app the traffic really belongs to, even on a common port.
Catches attacks
Scans for known attack patterns and malware, and can enforce detailed rules like "allow this site but block its file sharing."
🎬 Demo: same port, different contents
Every packet below uses port 443, which is allowed. Send the traffic through a stateful firewall first, then through an NGFW.
🎮 You are the NGFW
Every packet is on port 443. A basic firewall would wave them all through. Inspect the contents and decide.
Lesson 6
The Limits of a Firewall
A firewall is essential, but it's one layer of defense, not a complete solution. Here are four things it can't fix on its own.
1. It can't stop a user from being tricked
If someone gets a convincing message and types their password into a fake site, the firewall just sees normal, allowed web traffic. The attack went through the person, not an open port.
2. Encrypted traffic is a challenge
Encryption is good for privacy, but a firewall often can't see inside it without extra setup, and attackers can hide inside that encryption.
3. It mostly guards the border
A threat already inside, like an infected device or a malicious insider, can often act within the network without ever crossing the firewall.
4. It's only as good as its rules
One careless rule, like leaving a port wide open, can quietly undo much of its protection. Many real breaches come down to simple misconfiguration.
🧅 Layered defense
A firewall works best alongside other protections: strong authentication, up-to-date software, and users who know how to spot a scam. No single tool protects everything.
✅ Can the firewall stop it?
Lesson 7
Recap
- A firewall is a barrier between networks. It inspects traffic and decides what to allow and what to block, based on a set of rules.
- It makes those decisions using information on each packet, like addresses, ports, and protocol.
- Rules are read top to bottom and the first match wins.
- The safest approach is deny by default: block everything, then allow only what's actually needed.
- Firewalls range from simple packet filters, to stateful firewalls that track connections, to next-generation firewalls that inspect the actual content of traffic.
- A firewall is one layer of defense. It can't stop a user from being tricked, and it's only as good as its configuration.
Key terms
Final
Final Quiz
20 questions covering the whole lab. You need 70% to pass. When you submit, you'll get a results page to print or save as a PDF and hand in to your instructor.
Instructor tools: verify a results code
Enter the details exactly as they appear on the student's results page. A matching code means the name, score, and date haven't been edited.