Firewall
A barrier that allows or blocks traffic by rules, which is what stops a proxy on an unusual port from being reachable on a restrictive network.
A firewall decides which traffic may pass a boundary and which may not, according to rules about addresses, ports and protocols. It is the oldest and most general network control, and in its classic form it is blunt on purpose: permit outbound connections on these ports, refuse everything else, drop unsolicited inbound. Every corporate network, most home routers and every cloud environment run one.
For proxy users the firewall is usually met as the invisible reason something does not work. A proxy listening on an unusual port, 1080 for SOCKS or 8080 for HTTP, is unreachable from a network whose firewall permits outbound traffic only on 80 and 443, while the same proxy works perfectly from a less restrictive connection. The proxy is healthy; the firewall between you and it is not letting you out. This is the single most common cause of a proxy that answers from your phone and not from the office.
It is worth separating the firewall from the more sophisticated defences elsewhere in this glossary, because the words get blurred. A classic firewall filters on the envelope, addresses and ports, and does not read the request. A web application firewall inspects the request content for attacks, and a bot manager judges whether you are human. All three can refuse you, but a plain firewall refuses on where you are connecting from and to, not on who you appear to be, which is why changing your address rarely helps against it and changing your port sometimes does.
The same mechanism runs in both directions and both matter. Outbound firewall rules on a network you are on decide whether you can reach a proxy at all. Inbound firewall rules on a server decide whether a self-hosted proxy is reachable from outside, which combines with NAT and port forwarding to determine whether anyone can connect to something you are running. Diagnosing a connectivity failure often comes down to working out which firewall, on which side, is doing the refusing.
Frequently asked questions
Why does my proxy work at home but not at work?
Usually an outbound firewall on the work network. Restrictive networks permit outbound connections only on expected ports such as 80 and 443, so a proxy listening on 1080 or 8080 is blocked on the way out while working fine from a home or mobile connection. The proxy is not down; the firewall between you and it is refusing the port.
Is a firewall the same as a web application firewall?
No. A classic firewall filters traffic by address, port and protocol without reading the request. A web application firewall inspects request content for attacks such as injection. One decides whether a connection is allowed based on its envelope; the other decides based on what the request contains. They solve different problems and are often present together.
Can a firewall detect that I am using a proxy?
A basic one is not trying to; it allows or blocks by port and address rather than judging who you are. It can block the ports proxies commonly use, which prevents a connection without detecting anything. Identifying proxy use in the sense of scoring your traffic is the job of the more sophisticated layers, not of a packet-filtering firewall.
Back to the full glossary.