Firewall
Software or hardware that controls which network traffic is allowed to reach a server, based on rules such as IP address and port. A firewall does not check whether existing accounts or files are already compromised, it only decides what gets in.
What a firewall does not protect against
A firewall controls which network connections are allowed to reach a server; it has no visibility into what happens inside a connection it has already allowed, such as a weak password being guessed over an open SSH port.
The most common configuration mistake
Leaving every port open by default and trying to remember to block the risky ones individually. A default deny policy, where everything is blocked unless specifically allowed, is far harder to get wrong by omission.
Frequently asked questions
Do I need a firewall if my hosting provider already has one?
Yes, in most cases. A provider-level firewall and a server-level firewall (like iptables, nftables or ufw) serve as independent layers, and relying on only one leaves you exposed if the other is misconfigured or absent.
Which ports should always stay open?
Only the ones actively in use, typically SSH and whatever your application serves, such as 80 and 443 for a web server. Every additional open port is unnecessary exposure.
Can a firewall stop a DDoS attack?
A basic firewall can block obviously malicious individual sources, but a large-scale volumetric attack usually requires upstream mitigation from the hosting provider or a specialized DDoS protection service.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab