How does a firewall decide what can pass?

Policy at a boundary

A firewall filters traffic; it does not explain every failure.

A firewall can inspect traffic entering or leaving a host or network and compare it with rules. A rule may allow or deny a protocol, port, source, destination, direction, or connection state.

Filtering can happen on a device, a router, a cloud security group, or a service edge. A timeout may suggest silent dropping, but it is still evidence to compare with logs, captures, and tests from another location.

Build the model

Four rule ingredients

Evaluate the policy

Rule order and the default action shape the result.

Many firewalls evaluate rules from top to bottom and apply the first matching action. A broad allow rule placed above a specific deny can make the deny unreachable. A packet that matches no rule then follows the policy's default action, often deny or reject.

A least-privilege policy allows only the traffic needed for a stated purpose. Specific rules, a deliberate default, and decision logs make the boundary easier to review and troubleshoot.

Track the conversation

Stateless filters packets; stateful filters sessions.

A stateless firewall evaluates each packet against its rules without remembering earlier packets. The policy must describe both directions explicitly, including the return traffic.

A stateful firewall records connection information such as addresses, ports, protocol, and state. After allowing a new outbound connection, it can recognize the matching return packets as established traffic. This is a policy decision backed by remembered session state, not an automatic guarantee that every related packet is safe.