A firewall inspects network traffic against a defined set of rules and blocks anything that doesn't match, acting as a checkpoint sitting between a trusted internal network and an untrusted outside one. Modern firewalls actually do that filtering at multiple different levels of sophistication, from simple checks against source and destination addresses and ports, up to genuinely inspecting the actual content of a connection to decide whether it's legitimate.
Firewalls range from simple address filtering up to inspecting a connection's content
The simplest firewalls filter packets purely by source and destination address and port, blocking or allowing traffic based on fixed rules with no memory of any earlier traffic. Stateful firewalls go further, tracking each connection's ongoing state so they can recognise legitimate return traffic for a connection that was properly initiated, rather than just judging each packet in isolation. Application-layer firewalls go further still, actually inspecting a connection's real content against the specific protocol it claims to be using, catching traffic that's technically well-formed but doesn't actually behave the way it should.
A firewall is one layer in a wider defence, not a complete solution on its own
A firewall can't stop every kind of attack, it does nothing against a malicious actor who already has legitimate access from inside the network, and it can be defeated by traffic deliberately crafted to look legitimate at whatever level the firewall is actually inspecting. That limitation is exactly why firewalls get deployed as one layer within a wider defence-in-depth strategy, paired with regular patching, active monitoring and encryption, rather than treated as a single, sufficient security measure on their own.
What we're still unsure about
That firewalls filter traffic at genuinely different levels of sophistication, and that they only form one layer within a wider security strategy, are well established, uncontroversial facts of network security practice. What's more genuinely an open, actively evolving question is that as more network traffic gets encrypted end-to-end by default, a traditional firewall increasingly cannot inspect the actual content passing through it at all, and security engineers continue to actively debate how much of the classic perimeter-firewall model still makes sense compared with newer zero-trust approaches that assume no part of the internal network can automatically be trusted either.
This sits inside Network Security & Firewalls, one of seven topics in Networking, one of seven domains in Computer Science, one of seventeen subjects the app can quiz you on.