Firewalls

A firewall enforces rules about what is allowed to reach what. This may talk to that, on this port, and nothing else.

What it cannot do is tell you whether the permitted conversation is a good one. Traffic that matches the rules passes, whether it is an ordinary request or an attack dressed as one, because the firewall is checking the envelope rather than the contents. That is not a criticism, it is what the tool is. Problems start when it is treated as a verdict on safety rather than a constraint on reachability.