Firewall

A firewall is a security system that controls network traffic between a device or network and its surroundings. Based on defined rules, the firewall decides which connections to allow and which to block, forming a barrier that separates a trusted internal network from the potentially dangerous internet. A firewall is one of the foundations of server protection: it reduces the attack surface by blocking access to services that should not be publicly visible.

How a firewall works

The firewall analyses passing packets and compares them against a set of rules describing, among other things, source and destination addresses, ports and protocols. A rule can allow, reject or silently drop a packet. Modern firewalls are stateful: they track the context of connections, so they can tell an established, legitimate session apart from an unwanted attempt to reach in from outside. On Linux servers, the firewall is most often implemented by iptables or nftables.

Types of firewall

There are network firewalls (filtering traffic at the packet and port level), application firewalls (WAFs) that inspect the content of HTTP requests, and next-generation firewalls that combine these functions with content inspection and threat detection. An application firewall is implemented, for example, by ModSecurity.

Practical applications

On VPS and dedicated servers, a firewall is used to expose only the necessary ports (such as 80 and 443 for web traffic) and close the rest. Combined with Fail2ban, it automatically blocks addresses running brute-force attacks. Firewalls also support protection against DDoS attacks and enforce rate limiting. In managed services, firewall configuration is one of the first steps of server hardening, done before the actual applications are launched.