What is a firewall and do I need one?

Firewalls have a fearsome reputation left over from an era when computers connected directly to the internet with no router in between. The modern home is protected by default, and understanding why saves money and anxiety.

Step by step

1. Understand what a firewall actually does.It decides which network connections are allowed. Incoming connections nobody asked for are blocked; connections your own software starts are allowed out.
2. Recognise that your router is the main one.Home routers use network address translation, which has the side effect that unsolicited traffic from the internet has nowhere to go. That is the bulk of the protection, and it is on by default.
3. Check the built-in software firewall is on.Windows Security includes one; macOS has a firewall setting in privacy and security. Both are adequate. Confirm they are enabled rather than replaced by something you installed years ago.
4. Answer prompts about new software sensibly.When a program first wants to accept connections, you will be asked to allow it on private or public networks. Allow on private only, unless you specifically need it reachable elsewhere.
5. Set network types correctly.Marking a network as public tightens the rules and hides the machine from others on that network. Cafes, hotels and airports should always be public; home can be private.
6. Leave port forwarding alone unless you need it.Opening ports on the router deliberately exposes a device to the internet. It is occasionally necessary for games or a camera, but each one is a hole you have made on purpose.
7. Do not run two software firewalls.A security suite that installs its own alongside the built-in one causes conflicts and confusing failures without adding protection.
8. Put the effort where the risk actually is.Modern compromises come through browsers, email, downloads and passwords, not through unsolicited inbound connections. Updates, unique passwords and two-factor do far more than any firewall product.

Tips

• If a game or a media server does not work, the firewall prompt was probably declined once. Look for the program in the firewall's allowed list rather than turning the firewall off.
• Never disable the firewall to fix something. Allow the specific program instead — that is what the allowed list is for.
• Router firmware updates matter more than firewall settings. An unpatched router is a genuine risk; check for updates or enable automatic ones.

Common mistakes

• Buying a security suite for its firewall — The built-in ones are competent and already running. Paid suites in this category mostly add overhead and nag screens.
• Turning the firewall off to troubleshoot and leaving it off — It is a diagnostic step, not a fix. If turning it off helps, the answer is an allow rule for that one program.

If it doesn't work

Questions people ask