A Firewall Is a Bouncer, Not a Force Field

People talk about firewalls like they're a magic shield. "Is your firewall on?" gets treated as the whole security conversation. It's worth knowing what one really does, because it's genuinely useful and also much narrower than the name suggests.

At its core, a firewall looks at network traffic coming in and going out and decides, based on rules, whether to let it through. The rules mostly care about addresses and ports. Where's this coming from? Where's it going? Which port? Is it TCP or UDP? Allow or drop.

Ports are the key idea. A server might run a website on ports 80 and 443, SSH on 22, and a database on 3306. Each of those is a door. A firewall lets you say "the web ports are open to everyone, SSH only to my home IP, and the database to nobody outside this machine." Anything you didn't explicitly allow gets turned away at the door.

Modern firewalls are also "stateful," which means they remember connections. If your laptop reaches out to a website, the firewall knows the reply is part of a conversation you started and lets it back in. Random traffic that nobody asked for gets dropped. That's why your home network is already pretty well protected from unsolicited inbound connections without you configuring anything. Your router only forwards inbound traffic it has a reason to, which in practice works a lot like a firewall rule of "nothing comes in unless we started it."

On a Linux server, ufw is a friendly way to set this up. A sensible starting point:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Allow SSH before you enable it. On a remote server, forgetting that step locks you out, and it's one of the most common ways people do it.

One gotcha if you use Docker: when you publish a container port, Docker writes its own firewall rules that can bypass ufw entirely. So a database container published on 0.0.0.0 can be reachable from the internet even though ufw says the port is closed. Bind those to 127.0.0.1 instead, or put them behind a reverse proxy, and then check from outside that the port is actually closed.

Now the part people miss. A firewall only controls which doors are open. It doesn't care what happens once someone walks through an open one. If your website on port 443 has a vulnerable plugin, the firewall will politely let the attack in, because port 443 is allowed. If you click a phishing link and type your password into a fake site, that's outbound web traffic, which is allowed. Malware that sneaks in through an email attachment isn't stopped by a port rule either.

There are fancier kinds that look deeper. A web application firewall inspects the actual HTTP requests and tries to block things that look like attacks. "Next-generation" firewalls in businesses can identify applications and filter by them. Those help, but they're still a layer, not the whole plan.

So yes, keep it on, on your computer and on any server. Close every port you don't need, because each closed door is one less thing to worry about. Then keep your software updated and your accounts locked down, because that's where the stuff that gets past the bouncer gets dealt with.