The firewall is a station facility that segments and defends an Infonet. A relay holding one is a border: the relays that link without passing through a firewall form a segment, and a firewall is the only way into the segments it borders. A network with no firewall is one segment.
Rules
Its owner sets two rule sets. Inbound rules decide which other sides, and which kinds of packet, may cross into a segment through it. Outbound rules decide which kinds of the owner's own packets may cross out of a segment, to another of its segments or out of its network. A new firewall lets everything across. A dropped packet is gone: the order or program change it carried fails, and the firewall's owner sees the packet's header, never what it carried.
Doors
Other sides enter a network only at a relay its owner has opened to them, and a segment with firewalls is left only through one of them. In a segment with firewalls, that relay must be one of its firewalls, and its inbound rules decide who passes. A single firewall can close a whole network; a broken one opens everything behind it.
Construction
It is built from processors, circuits and frames. A relay or a Forward HQ can hold one. It draws power all the time. While unpowered or while its station is disabled, it still marks the border but lets every packet through.