To do so, a firewall will inspect packets sent to and received from the Internet. Based on rules defined by it's administrator or manufacturer, the firewall will allow certain data to pass while it will block other data. Many firewalls will track rejected packets in a log. The administrator is encouraged to regularly inspect these logs. Dshield.org collects such logs to allow firewall administrators to compare notes and improve firewall rule building.
Firewall implementations vary widely.
In it's most basic version, they will inspect headers and try to determine if source and destination are defined as 'allowed', or if the packet is a response to a request sent earlier. More sophisticated firewalls will inspect the content of the packet as well, and alert the user if the content matches data defined as sensitive. Firewalls do not replace virus scanners and safe computing practices.