What does a firewall inspect between public internet traffic and your web server?
A firewall inspects traffic trying to reach a service on your server and applies the policy you set. It sees the source address, destination, port, and, on a stateful device, whether the packet belongs to an existing connection, then allows or drops it. It does not rewrite your site, choose strong passwords, or keep a file backup.
| What it can see | Decision it makes | What it does not do |
|---|---|---|
| Address, port, and protocol | Allow the packet or drop it | Edit application code |
| Connection state, on a stateful firewall | Whether this packet continues an allowed conversation | Prove the sender is a real customer |
| Which interface the packet arrived on | Which services are reachable from the public internet | Store a copy of your site |
If port 443 is allowed, the firewall has done its network job. Anything inside that HTTPS request is a later problem for the application and, if you use one, a web application firewall.
How does a data-center hardware firewall filter network-layer (L3/L4) attacks?
A hardware firewall is a device, or a filter in the routers in front of the servers, at the network and transport layers. It drops packets aimed at closed ports, keeps management addresses off the public internet, and can absorb noisy floods. An allowed web port is still web traffic. A harmful request inside a normal HTTP call stays invisible.
- Put the filter at the edge, in front of the VPS or dedicated server, not only on the guest after the traffic has arrived.
- Publish the site on ports 80 and 443. Do not publish the database port.
- Restrict SSH or Remote Desktop to addresses that actually administer the machine.
- When a flood is larger than one server, the edge service has to take it. A guest firewall cannot add bandwidth the uplink does not have.
That last case is what a DDoS protection service is for. A small host rule is not a substitute for filtering that happens before the virtual machine.
How do host-based software firewalls (CSF, UFW, firewalld, Windows Firewall) work on a VPS?
A host firewall is software on the virtual machine. Its policy applies only to that machine. Linux admins commonly use CSF, UFW, or firewalld. Windows Server uses Windows Firewall. They can allow HTTP and HTTPS and limit SSH or Remote Desktop even when an upstream rule is wide. They cannot see packets the network never delivers to the guest.
| Tool | Where it usually runs | What you use it for |
|---|---|---|
| CSF | Linux servers, often beside a panel | Port policy plus simple allow and deny lists |
| UFW | Ubuntu | A short allow list for SSH and the web ports |
| firewalld | AlmaLinux, Rocky Linux, and similar systems | Zones that separate public services from admin access |
| Windows Firewall | Windows Server | Rules for Remote Desktop and the web server |
The clicks and the first rules for CSF are on the CSF firewall install guide. Open the port the application needs. Do not open every port because one test failed.
How is a Web Application Firewall (WAF) different from a network firewall?
A network firewall usually allows port 443 and stops. A WAF then reads the HTTP request. It can block an injection or script pattern, and a too-broad rule can also block a real customer. It is an application-layer control. It does not close SSH, and it is not a second hardware firewall.
| Network firewall | Web application firewall | |
|---|---|---|
| Layer | Network and transport | HTTP |
| Typical allow | Port 443 is open | A request that matches no block rule |
| Blind to | The words inside a form post | Packets that never become HTTP |
| Does not replace | Checks written in the application | The edge or host firewall |
Rule sets, false positives, and where a WAF sits on an account are covered on the web application firewall guide. Use that page when the question is which requests to block.
Why do production websites need both perimeter hardware filtering and a host/WAF firewall?
The perimeter filter drops traffic that should never reach the machine. The host firewall still matters when a new service or a missed edge rule exposes a port later. The WAF checks the web requests you allowed through both layers. Drop any layer and some traffic goes unwatched. Patches, unique admin passwords, and a restorable backup stay separate jobs.
- Edge: drop closed ports, and noisy network floods, before they hit the guest.
- Host: keep SSH, the panel, and databases off the open internet.
- WAF: inspect the requests that real visitors must be allowed to send.
- Still required: updated software and a backup you have actually restored once.