Why Android phones do not have firewalls?

Question

By default, Android phones don't have firewall (unless the user roots the phone and installs it themselves).

On Windows PCs, they have a built-in firewall, and warn the user of security risks if they disable it.

That doesn't make sense, since phones aren't being less exposed to malicious networks than computers. And even more, most Android phones can't be updated to received the security patches after the OEM support period ends, while Windows PCs still can receive security updates for a long period of time.

Answer 1

Most consumer firewalls block incoming connections only and allow all outgoing traffic. This is to make configuration easier; you enumerate what services you are running and want to allow, but you do not need to enumerate all the kinds of outgoing connections you want to allow.

Most Android devices do not run as servers. Setting up a server process that can listen and respond continuously breaks power-saving features. If you want to send data to an Android device, you get the Android device to connect to you, possibly alerting or sending via cloud messaging, which is a connection setup and managed for power-saving from the Android client-side.

What will a consumer firewall do for a device that isn't running services? Nothing, because there is nothing listening that you can block traffic to.

If you run server processes on your Android device, this situation obviously changes, but this is not the expected normal usage.

Answer 2

Since your home router blocks all incoming ports by default, and your phone still works, you can still use a firewall, but I don't see an actual reason for that.

The truth is, there is no need for a firewall for Android devices as long as you use reputable Android apps from the Google store. You are unlikely to encounter any issues as long as you are not using any suspicious apps which leak information (even reputable apps from the Play Store may leak private information to third parties for the purpose of advertising, and that one may not like it).

Even though you installed a firewall on your device, you are not fully protected against WiFi eavesdroppers in cafes, coffee shops, airports, schools, and hotels. In such a case, you can secure your wireless internet connection using a VPN connection to create several security layers. When connected to a VPN, all your Internet traffic is sent from your computer/device through an encrypted tunnel to the VPN provider’s network. Thus it’s encrypted and secured from any local Wi-Fi eavesdroppers at the hotspot.