Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to figure out where a firewall application on a server fits into the software stack, and at what point in the networking process the firewall "kicks in," from the perspective of an application on a server trying to communicate out, through the software firewall on the same server.

Without a firewall:

program asks OS for port; then poof:
program --> port --> internet

Where does firewall fit?

program asks OS for port; then poof:
program --> firewall(block/pass) --> port --> internet


program asks OS for port; then poof:
program --> port --> firewall(block/pass) --> internet
share|improve this question
It might be helpful to identify the OS and firewall in question. – mfinni Apr 29 '14 at 15:04
@mfinni If a particular OS and firewall make a difference to the process, that would be part of a good answer.... hint, hint. =D – HopelessN00b Apr 29 '14 at 15:06

Put simply, the local firewall on your machine acts as a gatekeeper for actual traffic that will be passing through your operating system's network stack.

So, it'd go as such:

Software -> Network Stack (In/Out) -> Firewall -> Network

It does not prevent port bindings as the kernel handles this. It will however prevent traffic on the port(s) if configured to do so.

share|improve this answer

There are (for all practical purposes) two different layers in play with what you're asking.

An app asking for a port binding is at a different level than where the firewall operates. An app will talk directly to the TCP/IP stack to get a binding. That happens completely independently of any firewall, regardless of if the firewall is local to the app host or a remote system.

Firewalls will intercept packets on ports they are configured to pay attention to once the bindings have already been granted. Then, once packets start flowing through those ports, the firewall can do its work and inspect the traffic. That's when the firewall will do it's allowing or blocking.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.