A firewall monitors all incoming and outgoing traffic and matches a set of security rules to determine whether to accept, reject, or drop a packet.

When a rule is matched, an action is performed on the network traffic. For example, a firewall table might match network traffic against a rule specifying that employees from the HR department are forbidden from accessing data from a code server, and another rule may specify that system administrators are permitted to access both HR and technical data. A firewall can be designed to suit the organisation's security and efficiency needs by combining rules.

A firewall operates in two phases. It blocks both outgoing and incoming network connections. On the one hand, a firewall allows outgoing connections from a server. In this case, outgoing connections are permitted from a firewall's perspective. On the other hand, it is always best to set a firewall rule to block outgoing connections. This is because doing so will improve security and prevent unwanted communication. As mentioned above, ICMP messages are the most common type of incoming traffic. They have a source IP address and a destination IP address. Port numbers are also included in TCP and UDP communications. In the case of incoming ICMP packets, the type of message is used as opposed to a port number.