diff --git a/Glossary.md b/Glossary.md
index 5502e0a..813dc57 100644
--- a/Glossary.md
+++ b/Glossary.md
@@ -19,6 +19,10 @@ A Tailscale Domain is a network. Each email domain is (currently) its own domain
 
 See https://tailscale.com/kb/1013/sso-providers
 
+## Firewall
+
+A firewall limits what network traffic can pass between two points. Firewalls can be hardware-based or software-based. Tailscale includes a built-in firewall, defined by the domain's ACLs.
+
 ## Identity Provider
 
 Somebody who proves you are who you say you are: Google, Okta, Microsoft, etc. Tailscale is not an identity provider (there are no Tailscale passwords, for instance); we're a "relying party" of other identity providers.