What Is a Server Firewall?

A firewall is a set of rules that decides which network traffic may reach a server and which may leave it. Traffic a rule allows gets through; the rest is dropped. It keeps services you did not mean to publish, such as a database port, out of reach of the internet.

How it works

Each rule names a direction (inbound or outbound), a protocol such as TCP or UDP, a port or range, and a source or destination address, plus what to do: allow, drop or reject. A common setup is to allow the few ports a server needs, such as SSH from your own address and the web ports from anywhere, and let everything else in be dropped.

A firewall can run inside the server, as software like UFW, or in the network in front of it. A network firewall is enforced before traffic reaches the server, so it still applies if something inside the server is misconfigured. Most firewalls are stateful: replies to traffic you allowed are let back through without a rule of their own.

When to use it

• Every server with a public port, to allow only what it needs.
• Databases and admin tools that only one server or one office address should reach.
• Groups of servers that should share the same rules.

When not to use it

• As the only security. A firewall limits who can connect; keep software updated and use strong passwords and SSH keys too.
• To block a whole kind of misuse, like spam from a web form. That needs the app's own controls.
• To make a service reachable. A firewall only filters; to publish a port, forward it in the server's shared IPv4 port block or give the server a dedicated IPv4 address.

How it works on VeloxaHost

• Network-level. Rules are enforced on the server's network interface, before traffic reaches the server, whatever runs inside it.
• Named and reusable. Create a firewall under Firewalls, add rules, and attach it to one server or many. A change to the rules applies to every server it is attached to.
• Default behaviour. Until you attach a firewall, traffic to and from the server is allowed. Once one is attached, inbound traffic that no rule allows is dropped; outbound stays allowed unless a rule drops it.
• Stateful. Return traffic for an allowed connection is let back in automatically.
• Rules. Direction (ingress or egress), action (allow, drop or reject), protocol (TCP, UDP, ICMP or any), and optional ports and addresses. There is no rule priority.
• Port 25. Outbound mail on TCP port 25 is blocked by default, to keep the network off spam lists.
• Still reachable. The browser terminal and serial console work even when your firewall blocks SSH.

Firewalls work on every VPS size and through the API.

FAQ

Is traffic blocked before I attach a firewall?

No. Until you attach one, traffic is allowed, apart from outbound TCP port 25.

Do I need UFW inside the server as well?

It is optional. A VeloxaHost firewall is enforced before traffic reaches the server; UFW inside it adds a second layer if you want one.

Can one firewall protect several servers?

Yes. Attach it to as many servers as you like, and its rules apply to all of them.

What if I lock myself out of SSH?

Use the browser terminal or serial console in the console, which do not depend on SSH, and fix the rule.