What is a firewall? How to set one up to protect your server

In September 2026 alone, we had to clean up 12 websites infected with malware. What all of these projects had in common was an administrator leaving the server's network ports wide open. What is a firewall? A firewall is a security system that sits between your network and the internet. Its job is to inspect all data passing through the network connection. The system decides whether to allow or block data based on the rules you set. You only need to set up these traffic rules correctly. The server will then automatically avoid most of the scans run by hackers' tools.

1. What is the core nature of a firewall system?

A firewall is a network security barrier. At MONA we like to compare it to the ticket checkpoint at an airport gate. Every passenger must show a valid ticket to pass through. A network server works exactly the same way. We often tell customers: a firewall only decides who may knock on the door, while killing viruses is a different job.

Data on the internet travels in small packets. A firewall strips off the outer layer of each packet to inspect it. It checks the source network address of the incoming traffic. It also checks the destination address on the server. This inspection runs continuously, every second, on every network connection.

If a packet is valid under the rules, the system lets it through right away. If it detects a risk, the firewall blocks it and discards the packet at the edge of the network. This inspection keeps malware from getting into your server. Conversely, it also stops sensitive data from being quietly smuggled out to the internet by hackers.

A network without a firewall is like a house with every door open. Anyone on the internet can probe and connect straight to the open ports. A firewall lets you hide the ports that don't serve users. Attackers can't see the weak points they would need to steal your data.

It doesn't only keep strangers out. It also controls the programs running inside the operating system. When malware slips into a server, it tries to phone home to the hacker's server. A properly configured firewall blocks that outbound traffic.

2. What types of firewall are there, and how do hardware and software firewalls differ?

Firewalls are usually divided into two main groups: hardware and software. We see many people working on personal projects wonder which kind to buy. In practice, each type solves a different security problem for a different network.

A hardware firewall is a standalone physical device. Picture a network box plugged straight into the fiber cable. All network signals from outside must pass through this box before reaching the servers inside.

The device has its own processor dedicated to analyzing network packets. That way, the main server doesn't spend resources on filtering data. Large financial groups often buy hardware to protect hundreds of computers at once. The one drawback is that the equipment is usually very expensive. Configuring it also requires a network engineer with deep operating expertise.

A software firewall is a program installed right on the operating system of your VPS. This kind of security doesn't require you to spend money on extra physical hardware. Linux and Windows servers both come with built-in network management software. You only need to type a few commands in the terminal to turn it on right away.

It filters data at the gateway of the operating system kernel. It is extremely flexible, and its rules are easy to change for each specific project. Ordinary web applications only need a software firewall to reach a safe standard. However, this software shares part of the host server's CPU and RAM to process its rules.

3. How does a firewall filter packets?

A firewall works according to rules that people configure in advance. We often advise developers to understand how these rules take priority over one another, to avoid locking themselves out of the server.

The system always reads the rule list in priority order, from top to bottom. Each service on the server is assigned its own communication port. Port 80 is typically used to show the website in an outside browser. Port 22 is used by default for technicians to connect to the admin console.

When traffic arrives, the firewall takes the destination port and matches it against the rules. Say you order a block on unknown IP addresses connecting to port 22. The firewall slams the connection shut from the very first second. Say you allow everyone on the network to reach port 80. The firewall opens the way so visitors can load the website normally.

These rules can be adjusted flexibly by IP address or application domain. Experienced administrators always start with a rule that blocks the whole network. Only then do they open, one by one, the ports that are really needed. This passive defense method gives the platform a very high level of safety.

Newer firewalls also add filtering by connection state. The system keeps a history of the connections of users working on the web. If a stray packet arrives that doesn't belong to an existing conversation, it is dropped immediately. To learn more about protecting web infrastructure, you can look at WordPress website security methods and plugins. The firewall protects the outer ring, while plugins keep the inner ring of the source code safe.

4. Common security solutions: UFW, iptables and WAF

Today's computing infrastructure offers many firewall tools to protect a system. At MONA, we often combine several layers of software to keep customer data safe. Understanding what each tool does will help you assign your layers of defense sensibly.

UFW (Uncomplicated Firewall) is a network management tool built into Ubuntu. UFW was designed to simplify otherwise complicated network configuration commands. A developer only needs to type one short command to close or open a network port. It is very friendly to people just learning basic Linux system administration.

iptables is the core packet filter that sits deep in the operating system kernel. It controls the network in fine detail, but its command syntax is long and hard to remember. UFW is really just a wrapper that makes it easier to drive the iptables process. Network specialists often prefer writing iptables rules directly to tune network parameters in depth.

A WAF (Web Application Firewall) is a firewall designed specifically for running websites. UFW and iptables can only block network traffic by IP address or port. A WAF can read and understand the content of web traffic reaching the server. It detects JavaScript malicious code being injected into login forms. It also stops queries deliberately written to damage the database.

WAF solutions are usually offered by infrastructure platforms such as Cloudflare to protect application bandwidth. This layer blocks millions of junk requests meant to take a website down. Many businesses also combine a WAF with a VPN architecture to grant staff secure access.

5. 5 minimum firewall rules for a VPS

A freshly created VPS is always facing a wave of automated scanners. We advise developers to set up the following 5 defensive rules right after receiving the server details. These steps take only a few minutes but give your application a lasting safety barrier.

The first rule is to open only the ports that directly serve your software. An ordinary website only needs port 80 (HTTP) and port 443 (HTTPS) to deliver content. Every other service port must stay closed. Closing unneeded ports reduces your platform's attack surface as much as possible.

Second, change the system administration (SSH) port right away. Attackers constantly run automated scans against the server's default port 22. Moving to a large random number breaks the script of those scanning tools. Your server will no longer be pestered by thousands of password-guessing attempts a day.

Third, block traffic by region or by suspicious IP address. A software project that only sells in Vietnam has no reason to accept traffic from distant countries. Set rules that block unfamiliar regions to remove the risk of malware attacks. Using a proxy server can sometimes hide the real visitor IP address. The firewall then needs extra configuration to read the real IP behind the proxy.

Fourth, turn off all software that runs in the background but isn't used. If a service isn't running, the operating system won't open extra network ports to the outside. The leaner the platform, the lower the chance of a system vulnerability appearing by accident.

Finally, keep access logs that trace the whole system. Every decision to block a network packet should be carefully recorded in a text file by the software. With this log data, technicians can review the traces of an attack when a risk alert comes in.

6. Protecting infrastructure and developing software on the MONA Cloud platform

When you rent and manage a traditional VPS yourself, network configuration often slows a developer's work. At MONA we build hosting solutions designed specifically for developers. The system automatically handles many complex network protection steps so you can spend your time writing code. We cleaned up 12 websites infected with malware in September 2026, mostly because the servers had unnecessary ports open.

The MONA Cloud infrastructure offers servers on a flexible pay-for-resources model. Rental is billed by the hour of use, starting from just 550 VND per hour for a small server. All service fees are paid directly in VND, with a full VAT invoice each month. You have complete control to turn the server on or off based on your actual testing needs. Once the system receives a shutdown command, CPU and RAM charges stop completely.

Getting your code into a live environment is extremely fast. Creating a new VPS takes just 11 seconds. App host configuration that issues an HTTPS certificate takes about 150 seconds. The platform runs very stably thanks to data infrastructure spread across 5 regions, from Vietnam to the US. Environments in Vietnam, Hong Kong or Singapore give very fast response times to local visitors.

Development teams can easily push code to the network through the built-in CLI. Engineers using AI can also work directly through the modern MCP standard. The MCP toolset connects the MONA infrastructure straight to Claude Code or Codex to control network commands automatically. The platform comes with network security configuration docs with detailed steps for setting up a firewall for your application platform.

Right now, every newly created customer account is MONA Cloud given 100,000 VND in credit added to its payment wallet. This trial budget is worth 180 hours of running a server at the standard configuration. You can use this credit to create a VPS right away and practice setting up network protection rules early.

FAQ

What is a firewall, and do all websites have to install one?

A firewall is a filtering layer that blocks malicious traffic from entering an internal network. Configuring a firewall is a mandatory operating step for any server that holds important databases. It creates an outer security barrier that stops hackers from trying to take control.

How do I turn off the firewall without cutting the network connection?

You need to log in with an account that has server administrator privileges to run the command that changes its state. The command ufw disable turns off the packet-blocking mechanism running on an Ubuntu server. Turn this mechanism off only briefly, to fix a software connection problem.

What is the basic difference between hardware and software firewalls?

A hardware firewall is a physical device completely separate from the main server. It uses its own chip to handle large volumes of network data smoothly. A software firewall, by contrast, is a program installed on the operating system of the server itself. It shares the CPU and RAM with other services.

Should I use UFW or a WAF to protect a website in its early stage?

You should run both layers of network protection on your application. UFW blocks the unneeded ports of the operating system environment. A WAF running alongside it analyzes incoming content to filter out sophisticated malicious code.