A firewall is the first line of defense between your machine and every bad actor scanning the internet. Most people have one and have never touched its settings. That defaults-only stance leaves gaps that are trivially exploited. This guide covers a proper 2026 setup on Windows, macOS, and Linux — plus what to do at the router level.
What changed in 2026
- nftables is now standard on Linux. Ubuntu, Debian, Fedora, and Arch all default to nftables; iptables is a legacy shim. Most tutorials still show iptables — ignore them.
- Windows Defender Firewall got better logging. The Event Viewer integration in Windows 11 24H2 makes rule auditing less painful.
- macOS Sequoia added per-app network prompts similar to iOS — every new binary must get explicit approval to accept connections.
- Router firmware caught up. Most mid-range routers in 2026 ship with stateful packet inspection and guest network isolation on by default.
Why firewalls still matter
| Threat |
Firewall stops it? |
| Port scanner finding open services |
Yes — block inbound |
| Malware calling home |
Partially — outbound rules help |
| Drive-by exploit on open port |
Yes — close the port |
| Phishing link you clicked |
No — different layer |
| Brute-force SSH |
Yes — block port 22 inbound or restrict by IP |
How to set up on Windows
- Open Windows Security → Firewall & network protection.
- Confirm all three profiles (Domain, Private, Public) show On.
- For advanced rules: search for Windows Defender Firewall with Advanced Security.
- Under Inbound Rules, disable any rules for apps you no longer use.
- For a home server: create a specific inbound rule on the exact port rather than "allow the app."
- Enable logging: right-click the firewall node → Properties → Logging → Log dropped packets → path
%systemroot%\system32\LogFiles\Firewall\pfirewall.log.
Tip: "Public" profile should be the most restrictive — enable it any time you're on Wi-Fi you don't control.
How to set up on macOS
- System Settings → Network → Firewall — toggle it on.
- Click Options to see per-app rules.
- Enable Stealth mode — your Mac won't respond to ICMP ping requests from the network.
- Add any server apps you run (web server, VNC) explicitly; remove apps you no longer need.
- For outbound filtering, Little Snitch (~$50/year) or the free LuLu are the practical options — macOS has no native outbound firewall UI.
How to set up on Linux (nftables)
Install and enable:
sudo apt install nftables # Debian/Ubuntu
sudo systemctl enable --now nftables
A minimal ruleset (/etc/nftables.conf):
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
ct state established,related accept
iif lo accept
tcp dport 22 accept # SSH — restrict to your IP if possible
icmp type echo-request accept
}
chain forward {
type filter hook forward priority 0; policy drop;
}
chain output {
type filter hook output priority 0; policy accept;
}
}
Apply with sudo nft -f /etc/nftables.conf. Reload on boot via systemd.
Router-level firewall
Your router is the perimeter firewall for every device on the network.
- Log into your router admin panel (usually
192.168.1.1 or 192.168.0.1).
- Enable SPI (Stateful Packet Inspection) if it has a toggle.
- Disable UPnP unless a specific app requires it — UPnP lets apps punch arbitrary holes in your firewall.
- Enable guest network isolation for IoT devices.
- Block inbound traffic on all ports unless you've specifically opened one for a self-hosted service.
How to pick the right approach
| Scenario |
Recommended setup |
| Home desktop, no servers |
OS firewall on, router firewall on, done |
| Self-hosting on home server |
OS firewall + specific port whitelist + router port forward |
| VPS or cloud instance |
nftables + fail2ban, no router involved |
| Office laptop on untrusted Wi-Fi |
"Public" profile on Windows / Stealth mode on macOS |
| Linux desktop |
nftables with default-drop inbound |
Common mistakes
Turning off the firewall to fix an app. Find the specific port the app needs and open only that.
Leaving UPnP on. UPnP allows any app to open inbound ports without your knowledge — disable it.
Never checking logs. Denied connection logs tell you if something is actively scanning you or if an app is misbehaving.
Using public profile for home network. Assign your home SSID to "Private" profile in Windows — Public is for cafes.
What to skip
- Third-party Windows firewall suites that cost money — Windows Defender Firewall with Advanced Security does everything a home or small-business user needs.
- Disabling the OS firewall because "the router handles it" — defense in depth requires both layers.
- Opening port ranges "just in case" — open only the exact ports you know an app uses.
FAQ
Do I need a firewall if I have a router?
Yes. The router blocks inbound from the internet, but the OS firewall also handles intra-network threats and outbound anomalies.
What ports should I always block?
Close everything not in use. Common targets for attackers: 23 (Telnet), 3389 (RDP open to internet), 445 (SMB), 5900 (VNC).
Does a VPN replace a firewall?
No. A VPN encrypts your traffic; a firewall controls which connections are allowed. They solve different problems.
Is nftables really replacing iptables?
Yes. iptables is a compatibility wrapper around nftables on modern kernels. New scripts should use nftables syntax.
Where to go next
See How to set up port forwarding in 2026, How to set up a guest network in 2026, and How to change DNS settings in 2026.