Server Firewalls in Hosting
How a Server Firewall Filters Traffic
A server firewall is a set of rules that decides which network connections may reach a server, and which are dropped or refused. It can run as a separate device in front of many servers, which hosts usually provide, or as software on the server itself, known as a host firewall. Either way, it is the first gate that incoming traffic must pass.
A firewall reads the addressing information in each packet of traffic: the source and destination IP addresses, the destination port and the protocol. The port tells the firewall which service a connection is aiming for, such as the web server or a mail service.
Many firewalls are stateful. They remember which connections were opened from inside the server, allow the replies, and block unrequested traffic trying to enter.
Allow and Deny Rules on Hosting Servers
Firewall rules are written as allow or deny decisions, checked in order. A common and safer design is default deny: all incoming traffic is blocked unless a rule explicitly allows it. Only the services the public needs, such as web traffic, are opened.
Consider a database server. Its database port should normally accept connections only from the web application or from administrators, not from the whole internet. A rule that restricts this port limits exposure, and it protects the data even if a password is guessed.
On shared or managed hosting, the provider usually runs a perimeter firewall for its whole network, and may add host-level rules for each server. Customers rarely control the provider's rules directly, so it helps to ask what is filtered before choosing a plan.
What a Network Firewall Cannot See
A network firewall works at the level of connections, not the content of requests. If a website must accept traffic on the standard web ports, the firewall has to let that traffic through, including requests that carry an attack. A malicious request sent to a public page looks the same to the firewall as an ordinary visit.
This is why hosting security usually combines layers. The firewall limits which doors are open, while a web application firewall inspects what visitors send through the open doors. Server hardening reduces the attack surface of the software behind them.
Frequently asked questions
Is a firewall enough to secure a website?
No. A firewall controls which network connections can reach a server, which is essential, but it does not examine the web requests inside allowed connections. Application flaws, weak passwords and outdated software need other protections, such as a WAF, updates and access controls.
Should a database port be open to the internet?
Generally no. Database services should accept connections only from the application servers or administrators that need them. A publicly open database port invites automated scans and password guessing. Firewall rules restrict access, and a private network connection is safer still where the host offers one.