A server firewall is a security system that inspects incoming and outgoing network traffic and applies rules to block or allow connections. It is the first line of defense for any server exposed to the internet.
In this article we explain how a server firewall works, exactly what it does, which types exist, and what minimum rules you should configure on a VPS or dedicated server.
What Is a Server Firewall For?
A firewall serves three core functions:
- Access control: defines which ports and IP addresses can connect to the server and which are blocked.
- Attack surface reduction: closes all ports that are not strictly necessary, minimizing entry points for an attacker.
- Damage containment: if an internal process is compromised, outbound (egress) rules can prevent it from connecting to command-and-control servers.
Without an active firewall, every open port on your server is reachable from any IP address on the internet — including automated bots that scan for vulnerabilities around the clock.
How Does a Server Firewall Work?
A firewall works with ordered rules. When a network packet arrives, the firewall compares it against the rule list from top to bottom until it finds a match; it then applies the corresponding action: ACCEPT (allow) or DROP/REJECT (block).
Each rule can filter by:
- Source or destination IP address
- Source or destination port (e.g., port 22 for SSH, 80 for HTTP, 443 for HTTPS)
- Protocol (TCP, UDP, ICMP)
- Connection state (new, established, related)
Most modern firewalls use stateful inspection: they distinguish whether a packet belongs to an already-established connection (and allow it automatically) or is a new connection that must be evaluated against the rules.
Types of Server Firewalls
Network firewall (perimeter)
Sits between the internet and the server — typically on a router, layer-3 switch, or dedicated appliance. It filters traffic before it reaches the server's operating system. In cloud environments, this is equivalent to Security Groups (AWS) or Cloud Firewall rules (DigitalOcean, Vultr).
Host-based firewall (software)
Runs directly on the server's operating system. On Linux, the base tool is iptables or its successor nftables. More user-friendly management tools like UFW (Ubuntu) or firewalld (CentOS/RHEL) simplify rule administration.
Web Application Firewall (WAF)
Operates at layer 7 (application) and inspects HTTP/HTTPS content, not just ports. It detects and blocks attacks like SQL injection, XSS, and web vulnerability scans. Cloudflare WAF, ModSecurity, and Imunify360 are common examples in hosting environments.
| Type | OSI Layer | Example | Best for |
|---|---|---|---|
| Network firewall | 3-4 | AWS Security Groups | Filtering IPs and ports before the server |
| Host-based firewall | 3-4 | UFW, iptables, firewalld | Granular control at the OS level |
| WAF | 7 | Cloudflare WAF, ModSecurity | Protecting web apps from HTTP attacks |
Basic Firewall Rules for a VPS or Dedicated Server
If you've just set up a VPS, these are the recommended minimum rules:
- Allow SSH only from your IP or trusted IP range (port 22 TCP). If you need access from anywhere, at least change the default port.
- Allow HTTP and HTTPS (ports 80 and 443 TCP) from any source, if you're serving a website.
- Block everything else by default (default policy: DROP). Open additional ports only when strictly necessary.
- Allow ICMP (ping) with limits — useful for diagnostics; you can restrict it to your IPs.
- Enable stateful tracking (conntrack) to automatically allow response traffic from established connections.
For mail servers, databases, or control panels, open only the relevant port and, where possible, restrict access to specific IPs.
If you manage your own infrastructure and want to make sure your firewall is configured correctly, the team at elenlace.com can review and harden your server security so you don't have to do it alone.
You can also explore hosting options in our VPS servers section, with guides on server types, control panels, and more.
Key Takeaways
- A server firewall filters network traffic and blocks unauthorized connections before they reach system services.
- It works by evaluating packets against an ordered rule list that considers IP, port, protocol, and connection state.
- There are three main types: network firewall (perimeter), host-based firewall (OS software), and WAF (web application layer).
- The minimum secure configuration on a VPS: allow SSH (ideally from known IPs), HTTP/HTTPS, and block everything else by default.
- Combining a network firewall with a host-based firewall and a WAF is the most effective defense-in-depth strategy.
Is your server's firewall properly configured? If you're not sure, contact us at elenlace.com for a basic security review. A misconfigured firewall can leave you just as exposed as having none at all.
FAQ
Does a server firewall replace antivirus software?
No. A firewall controls network traffic (who can connect and on which port). Antivirus software scans files and processes for malicious code. They are complementary security layers, not interchangeable ones.
Are UFW and iptables the same thing?
Not exactly. iptables is the Linux kernel's packet-filtering system (powerful but with complex syntax). UFW (Uncomplicated Firewall) is a frontend that simplifies iptables management with more intuitive commands. Both ultimately modify the same kernel-level rules.
Should I enable a firewall on a managed VPS?
Yes, always. Even if your provider manages the server, the host-based firewall is your responsibility. Many providers also offer a network-level firewall on their infrastructure layer — enable that too and use it as a first line of defense.
What happens if I accidentally block SSH access?
If you lose SSH access due to a bad rule, most VPS providers offer an emergency console (VNC or serial console) from their control panel. From there you can correct the rules without needing to reboot the server.
Useful resources
Other providers and guides worth comparing:
