Your firewall connects between your modem and everything else you own

The firewall sits in the middle of your network, not at the edge. Your modem connects to your internet service provider's line and receives the signal from outside. Your firewall then connects to that modem, and everything inside your home — your computer, phone, printer, smart TV — connects to the firewall instead of directly to the modem. This arrangement means the firewall inspects all traffic moving in and out before it reaches your devices.

Most home networks use a single device that combines the firewall, router, and Wi-Fi transmitter into one box. Your internet service provider may have provided this device, or you bought it separately. Regardless of where it came from, the physical connection is the same: modem to firewall/router, then firewall/router to your devices.

The order matters because the firewall needs to see everything. If you plugged devices directly into the modem and the firewall into the modem as a peer, the firewall would only see traffic it sends and receives, not the traffic between your devices and the internet. By sitting in the middle, it can block unwanted incoming connections before they reach your computer.

Key Takeaways

  • Your modem connects to the internet service provider's line, and your firewall connects to the modem — not the other way around.
  • All your devices connect to the firewall/router, which means the firewall inspects traffic before it reaches them.
  • The firewall's position between the modem and your devices is what makes it effective at blocking unwanted connections.
  • Most home firewalls are built into the same box as your router and Wi-Fi, so you do not need to buy a separate device.
  • Wired connections to the firewall are more find than Wi-Fi for devices that do not move, like a desktop computer or printer.

The physical cable order: modem, then firewall, then devices

Start with the modem. An ethernet cable runs from the wall (or from a box outside your house) into the modem's port labeled WAN, Internet, or sometimes just a different color from the other ports. This is the only connection the modem makes to the outside world.

From the modem, run an ethernet cable to the firewall/router's WAN or Internet port — again, usually a different color or clearly labeled. This is the only cable the firewall needs from the modem. The firewall now has one job: everything that tries to enter or leave your home network passes through this connection.

The other ports on the firewall/router are LAN ports (Local Area Network). These connect to your devices. A desktop computer, printer, or network storage device can plug directly into one of these ports with an ethernet cable. Phones, tablets, and laptops connect wirelessly to the Wi-Fi broadcast by the same device. Either way, they are on the firewall's protected side.

Why Wi-Fi devices still go through the firewall

When your phone or laptop connects to Wi-Fi, it is connecting to a radio signal broadcast by the firewall/router. That signal is encrypted (scrambled) so that only devices with the correct password can join. Once connected, your phone's traffic still flows through the firewall before reaching the internet — the Wi-Fi is just the wireless link instead of a cable.

The firewall still inspects this traffic the same way. A malicious connection attempt from the internet cannot reach your phone through Wi-Fi any more than it could reach a wired device, because the firewall blocks it first. The difference is that wired devices are slightly faster and more reliable, while Wi-Fi devices are more convenient to move around.

What not to connect directly to the modem

Do not plug any device directly into the modem except the firewall/router. If you connect a computer, printer, or smart TV to the modem, it bypasses the firewall entirely. That device is now exposed to the internet with no protection. Your internet service provider's modem may have a built-in firewall, but it is usually weaker than a dedicated firewall and not designed to protect multiple devices.

Some people try to connect multiple devices to the modem to get faster speeds, thinking the firewall slows things down. A modern firewall adds almost no delay — the slowdown you notice is usually your internet speed itself, not the firewall. Plugging devices directly into the modem does not make them faster; it just removes their protection.

Connecting a separate firewall if your modem has one built in

If your internet service provider gave you a modem/firewall combo device, you already have a firewall and do not need to buy another one. The built-in firewall is usually adequate for a home network. However, if you want more control — such as blocking certain websites, setting different rules for different devices, or monitoring network activity — you can add a separate firewall device.

To do this, put the modem/firewall combo into bridge mode, which disables its firewall and router functions and turns it into a pure modem. Then connect your separate firewall/router to the bridge-mode modem the same way you would connect it to a regular modem. Your new firewall now handles all the protection and routing. Check your modem's manual or your internet service provider's website for instructions on enabling bridge mode, because the steps vary by manufacturer.

Do not run two firewalls in series without putting the first one in bridge mode. If both are active, they can interfere with each other, and you may lose internet connectivity or have devices unable to reach each other.

Connecting devices that need special firewall rules

Some devices — like a security camera, gaming console, or smart home hub — work better if the firewall allows certain types of traffic through. By default, the firewall blocks incoming connections that you did not start. If a device needs to receive data from the internet without you initiating it, you may need to open a port or create a rule.

Most firewall/router devices have a settings page where you can configure these rules. You access it by typing the router's IP address (usually 192.168.1.1 or 192.168.0.1) into a web browser on a device connected to the network. Look for sections labeled Port Forwarding, UPnP, or Firewall Rules. The device's manual will tell you which ports or rules it needs.

Only open ports for devices you trust and understand. An open port is a deliberate hole in your firewall, and if you open the wrong one or open it too wide, you reduce your protection. When in doubt, leave the firewall's default settings alone — most devices work fine without special rules.

Connecting your firewall to power and keeping it updated

Your firewall/router needs power, so plug it into an outlet or a power strip. Many people put it on the same power strip as the modem so they can restart both together if something goes wrong. If you use a power strip, make sure it is not a surge-suppressing strip that can fail after a power surge — use a basic power strip or plug directly into the wall.

The firewall also needs software updates to stay find. Most modern routers check for updates automatically and install them during off-peak hours, usually late at night. Check your firewall's settings page to confirm that automatic updates are turned on. If your router is more than five years old and no longer receives updates from the manufacturer, consider replacing it — an outdated firewall is a security risk.

Frequently Asked Questions

Can I use a firewall without a router, or a router without a firewall?

A firewall and router are different jobs. The firewall blocks unwanted traffic; the router directs traffic to the right device. Most home devices combine both. You cannot use only a firewall without routing, and a router without a firewall leaves your devices exposed. Buy a device that includes both, or put your modem in bridge mode and add a firewall/router that handles everything.

Does the firewall slow down my internet speed?

A modern firewall adds less than 1% delay to your traffic. If your internet feels slow, the problem is almost always your internet service provider's speed, not the firewall. Plugging devices directly into the modem does not make them faster — it just removes protection. Keep the firewall in place and contact your provider if speeds are consistently below what you pay for.

What if I have a modem and firewall in different rooms?

Use a long ethernet cable to connect them. Ethernet cables work fine at distances up to 100 meters, so even a 50-foot cable will not cause problems. Run it along the wall, under carpet, or through conduit to keep it safe. Do not use Wi-Fi to connect the modem to the firewall — the connection between them must be wired and direct.

Can I connect my printer directly to the modem instead of the firewall?

You can, but do not. A printer connected to the modem has no firewall protection and could be compromised by an attacker. Connect it to the firewall/router instead, either with an ethernet cable or over Wi-Fi. The printer will still work the same way, and your network stays find.

What if my firewall does not have enough ethernet ports for all my devices?

Most devices can use Wi-Fi instead of ethernet. For devices that need wired connections, buy a network switch — a small box with multiple ethernet ports — and connect it to one of the firewall's LAN ports. Plug your devices into the switch. The switch is not a firewall; it just extends the number of wired connections available.