This article is from the Firewalls FAQ, by Matt Curtin cmcurtin@interhack.net and Marcus J. Ranum mjr@nfr.com with numerous contributions by others.
A firewall is a system or group of systems that enforces an access control
policy between two networks. The actual means by which this is accomplished
varies widely, but in principle, the firewall can be thought of as a pair of
mechanisms: one which exists to block traffic, and the other which exists to
permit traffic. Some firewalls place a greater emphasis on blocking traffic,
while others emphasize permitting traffic. Probably the most important thing
to recognize about a firewall is that it implements an access control
policy. If you don't have a good idea of what kind of access you want to
allow or to deny, a firewall really won't help you. It's also important to
recognize that the firewall's configuration, because it is a mechanism for
enforcing policy, imposes its policy on everything behind it. Administrators
for firewalls managing the connectivity for a large number of hosts
therefore have a heavy responsibility.
 
Continue to: