What is a firewall?

A firewall is a guard between your network and the internet. It checks every bit of traffic going in or out. It blocks anything you have not allowed.

That is the whole idea. Everything else, VPNs, traffic reports, VLANs, is built on top of that one job. Get the basic job right, and the rest is easier to understand.

What a firewall actually does

Every device you own sends and receives small chunks of data called packets. A web page, an email, a video call, all of it moves as packets. Each packet has an address on it, like an envelope.

A firewall reads the address on every packet before it goes anywhere. It compares that packet against a set of rules you control. Allowed traffic passes through. Everything else gets dropped, silently, before it ever reaches your devices.

Without a firewall, any device on the internet could try to talk directly to your laptop, your printer, or your security camera. Most of those attempts are scans looking for an easy target. A firewall is what stops them from ever getting a reply.

Why every network needs one

The internet is public. Anyone, anywhere, can send a packet toward any address, including yours. Most of that traffic is automated scanning, run by software that checks millions of addresses a day for anything left open.

A network with no firewall is not hidden. It is just unguarded. The scans still arrive. The only question is whether something answers.

• A home network without one leaves smart cameras and TVs reachable from outside.
• An office network without one leaves servers and printers exposed to the whole internet.
• Even a single laptop plugged straight into the internet is a target within minutes.

Your router's firewall vs a real one

Most home and small office routers include a basic firewall. It does one thing well: it stops unsolicited traffic from outside from reaching your devices. That covers the most common attacks, and it matters.

A dedicated firewall appliance does much more. It can look inside allowed traffic for known attack patterns, not just check the address on the envelope. It can split your network into separate zones, so a hacked camera cannot reach your laptop. It can run a VPN for staff working from home, shape traffic so one download does not slow down a video call, and keep a record of what happened when something goes wrong.

Industry shorthand for this fuller kind of device is NGFW. The name is not important. What matters is that it does more jobs than a router's built-in firewall, on purpose, as its main function rather than an afterthought.

What "stateful" means

Almost every real firewall today is a stateful firewall. That word describes how it remembers conversations.

Say your laptop asks a website for a page. The firewall notes that your laptop started that conversation. When the website's reply comes back, the firewall recognises it and lets it through. But if a stranger on the internet tries to start a new conversation with your laptop out of nowhere, the firewall blocks it, because nobody inside asked for it.

What a firewall does not do

A firewall is not a cure-all, and it helps to know its limits early. It guards the door between your network and the internet. It does not follow traffic once that traffic is allowed through.

• A firewall cannot stop a staff member from clicking a bad link in an email once the email itself was allowed in.
• A firewall cannot scan files on a laptop for a virus already sitting on the disk. That is a job for antivirus software running on the device itself.
• A firewall cannot fix a weak password. It can make a break-in harder to attempt, but a stolen password still gets used the way it was meant to be used.

None of this makes a firewall less important. It means a firewall is one layer, a strong one, sitting at the edge of your network. Good password habits, updated software, and careful staff still matter behind it.

Where Firecradle fits

Firecradle is a firewall appliance built on Ubuntu. It runs a stateful firewall as its base, then adds the rest of the fuller job: rule and signature-based threat detection, VPN, network segmentation, traffic shaping, and centralised management for a single site or a fleet of them. None of it needs a separate box.