a firewall
Picture a security guard at the single entrance to a building, holding a list of rules: this kind of visitor may enter, that kind must be turned away. Every person trying to get in or out passes the guard and is checked against the list. A firewall is that guard for a network — a device or piece of software placed at a network boundary that inspects traffic and decides, by a configured policy, what to allow and what to block.
The simplest kind is a stateless packet filter. It looks at each packet in isolation and matches it against a list of rules based on header fields: source and destination IP address, the protocol (TCP, UDP, ICMP), and the port numbers. A typical rule set might allow incoming TCP to port 443 (web) and 22 (SSH) but drop everything else inbound, while allowing outbound connections. Each packet is judged purely on its own headers — the filter keeps no memory of past packets, which makes it simple and fast but limited: it can't easily tell a legitimate reply from an unsolicited packet that merely looks like one.
Why it matters and a sharp limit: a firewall enforces a traffic policy, shrinking the 'attack surface' by blocking connections you never intended to expose — closing unused ports, keeping internal services off the public Internet. It's a cornerstone of network defense. But be honest about what it is not. A firewall is not antivirus and not a content scanner: if you allow web traffic on port 443, it cannot stop a malicious file or an attack hidden inside that allowed traffic, because it's enforcing where connections may go, not whether their contents are safe. It controls the doors; it doesn't inspect what's smuggled through an open one.
A server's firewall has one inbound rule: allow TCP to port 443, deny all else. A packet arriving for port 23 (Telnet) is dropped regardless of its contents — the door is simply closed. But a malicious request arriving on the allowed port 443 sails right through; the firewall judged the door, not the cargo.
Allow/deny by header rules — it guards doors, not cargo.
A firewall is not antivirus. It enforces which connections are permitted, not whether their contents are safe — an attack carried inside traffic you allow (say, over port 443) passes straight through.