What is a Firewall?

A firewall can be a hardware appliance that guards an entire network or a software program running on the device it protects. Your home router runs one, your laptop runs one, and the server hosting your website should be running one too.

In enterprise settings such as data centers, firewalls enforce far more complex rule sets, but the job never changes: decide which connections get through and which don't.

How a firewall works

A firewall compares each connection against a set of rules. A rule matches traffic by criteria such as source and destination IP address, port, and protocol, and states whether matching traffic is allowed or blocked. Administrators also set a default policy, often separately for inbound and outbound traffic, that decides what happens when nothing matches. How rules are weighed varies by firewall: many process the list in order and act on the first match, while Windows Firewall ignores rule order and lets explicit block rules override allow rules.

For anything public-facing, the recommended setup is default-deny on inbound traffic: block whatever you haven't explicitly allowed. That way you only describe the traffic you expect instead of predicting every attack someone might invent. Don't assume your firewall ships that way, though. Windows Firewall, for example, blocks unsolicited inbound traffic by default but allows all outbound traffic unless a rule says otherwise.

Stateful firewalls, the common modern kind, track established connections, so replies to traffic you started are allowed back automatically. Here's a typical default-deny rule set for a web server: allow TCP ports 80 and 443 from any address so visitors can load the site, allow SSH on port 22 only from your own IP address to shut out brute-force attacks on the login, and block everything else. A bot probing port 3306 for an exposed database matches nothing and gets silence.

Every firewall inspects packets; that's the baseline job. Advanced, next-generation firewalls go further with deep packet inspection, intrusion detection and prevention, and application-layer filtering, which catches threats like malware hiding inside traffic that simple port rules would wave through.

Types of firewalls

Firewalls are grouped by where they run and what they inspect:

• Network firewalls filter traffic at the edge of a network by IP address, port, and protocol. Packet-filtering firewalls check each packet on its own; stateful firewalls also track the connection it belongs to.
• Host-based firewalls are built into a single device's operating system: Windows Firewall, which ships enabled by default on every Windows edition, macOS's built-in firewall, and Linux tools like ufw and iptables.
• Web application firewalls (WAFs) filter the HTTP requests reaching a website and block application-layer attacks such as SQL injection and cross-site scripting. Our web application firewall guide explains how to set one up.
• Proxy firewalls stand between two networks as the gateway for a specific application, so outside systems never connect directly to the inside. That isolation adds security but can slow throughput.
• Cloud firewalls run in a provider's infrastructure instead of on hardware you own, filtering traffic before it reaches your network.

Network firewall vs. web application firewall

The two layers answer different questions, and a public website usually needs both:

• A basic packet-filtering network firewall decides from IP addresses, ports, and protocols alone; it doesn't examine what's inside a web request. Next-generation network firewalls can inspect application traffic too, but web attacks aren't their specialty.
• A WAF specializes in HTTP. It applies web-application rules to the requests reaching your site and blocks attacks such as SQL injection and cross-site scripting, which arrive over the same port 443 a network firewall has to leave open.

The network layer is normally your host's job. As a site owner, the WAF layer is the one to check for, because it guards the traffic your site must accept to function.

Do you need a firewall for your website?

Yes. A public web server is port-scanned and probed around the clock by bots hunting for open services, and a firewall keeps your exposure to the ports you actually serve. Who configures it depends on the hosting: with web hosting, the host runs the firewall; on a VPS or dedicated server with root access, the operating system's firewall is yours to enable and configure.

Every DreamHost plan includes web application and network firewalls at no extra cost, along with protection against DDoS attacks. Check what your host already includes before you install or pay for anything extra.

When firewalls go wrong

The classic failure is locking yourself out: enable a firewall on a remote server without first allowing SSH on port 22, and the connection you would use to undo the mistake is the one you just blocked. The quieter failure is a firewall left with a default-allow inbound policy, which filters nothing while looking like protection.

Two habits prevent both. Keep a second way in while you test new rules, such as your host's web-based console, and confirm the inbound default policy is deny before you trust the setup.