A firewall is the gatekeeper that decides which network traffic is allowed in and out of your systems. It is one of the most basic and most important layers of security you can have. Understanding the main types and how rules work will help you protect your servers without accidentally locking yourself out.
What a Firewall Does
A firewall inspects traffic against a set of rules and either allows or blocks each packet or connection. By default a well-configured firewall denies everything and only permits the specific traffic you have explicitly allowed, which dramatically shrinks the surface an attacker can reach.
Network vs Host-Based Firewalls
A network firewall sits at the edge of your network and protects everything behind it, filtering traffic before it ever reaches individual machines. A host-based firewall runs on a single server and protects just that host. They are not either-or: using both gives you defense in depth, with the network firewall providing broad protection and the host firewall guarding each server individually.
Stateful vs Stateless
A stateless firewall judges each packet on its own, with no memory of what came before. A stateful firewall tracks the state of active connections, so it can tell that an incoming packet belongs to a connection your server already started. Stateful filtering is smarter and is the standard for modern firewalls.
How Firewall Rules Work
Rules are typically evaluated in order, and the first matching rule wins, so ordering matters. Each rule usually specifies a source, a destination, a port, a protocol, and an action to allow or deny. A common pattern is to default-deny all inbound traffic, then add narrow allow rules for exactly the services you intend to expose.
Common Ports to Know
You will mostly work with a handful of ports: 80 and 443 for HTTP and HTTPS, 22 for SSH, 25, 465, and 587 for mail, and 53 for DNS. Only open the ports your services genuinely need, and restrict sensitive ones like SSH to trusted source addresses wherever possible.
Best Practices
Start from default-deny and open only what you need. Restrict administrative access like SSH to known IPs, keep your rule set documented and as small as possible, and review it regularly. Always make sure you have a recovery path, such as out-of-band console access, before tightening rules on a remote server so a mistake does not lock you out.
Web Application Firewalls
A traditional firewall works at the network and transport layers, but a web application firewall (WAF) inspects HTTP traffic itself. A WAF can block common web attacks like SQL injection and cross-site scripting, complementing rather than replacing your network and host firewalls.
How Noded Can Help
Whether you are locking down a single server or designing layered protection across your network, we can help you build a sensible firewall policy with safe defaults. Tell us what services you expose and who needs access, and we will help you secure them without locking yourself out.
FAQ
Do I need a firewall if my server has strong passwords?
Yes. Passwords protect individual logins, but a firewall limits what is even reachable in the first place. Reducing exposed services shrinks your attack surface no matter how strong your credentials are.
What is the difference between a network and a host firewall?
A network firewall protects everything behind it at the edge, while a host firewall protects only the machine it runs on. Using both provides layered defense, which is stronger than relying on either alone.
What does default-deny mean?
Default-deny blocks all traffic unless a rule explicitly allows it. It is safer than default-allow because you consciously permit only what you need rather than trying to block every possible threat.
Is a WAF a replacement for a firewall?
No. A WAF inspects web application traffic for attacks like injection, while a network or host firewall controls which ports and connections are allowed. They protect different layers and work best together.