Everyone's heard of firewalls. Most people have a vague sense they're something to do with security. Here's what they actually do and why they matter for anyone running servers.
The basic concept
A firewall controls what network traffic is allowed in and out of a system. It sits between your server and the network, inspects traffic, and applies rules to decide what gets through. Traffic that matches an allow rule passes. Traffic that matches a deny rule gets dropped. Everything else can be configured to either pass or drop by default.
Why you need one
If you put a server on the internet with no firewall, every port on that server is accessible to everyone. That means anyone can attempt to connect to anything running on any port — your database, your admin interfaces, your internal services. Bots scan the entire internet constantly looking for open ports and known vulnerabilities. A firewall means only the ports you've deliberately opened are reachable.
UFW — the practical option for Linux servers
UFW (Uncomplicated Firewall) is the easiest way to manage firewall rules on Ubuntu/Debian servers. Basic setup:
ufw default deny incoming ufw default allow outgoing ufw allow 22 # SSH ufw allow 80 # HTTP ufw allow 443 # HTTPS ufw enable
That locks down everything except SSH, HTTP, and HTTPS. Any other ports — your database, internal services, whatever else is running — are invisible to the outside world.
Don't lock yourself out
The classic mistake when setting up a firewall is enabling it without first allowing SSH, then being unable to reconnect. Always allow port 22 before enabling UFW. Always. I've seen people need to use a provider's rescue console to recover from this. Don't be that person.
Cloudflare as an extra layer
For web traffic I also use Cloudflare, which adds DDoS protection and can be configured to only allow traffic from Cloudflare's IP ranges at the firewall level. This means even if someone discovers your server's IP, they can't bypass Cloudflare by connecting directly — the firewall drops anything not coming from Cloudflare's network.