A firewall is a filter that decides which network traffic may reach a computer and which is dropped. Every server on the internet is scanned within minutes of going online, so a firewall is the first layer that keeps unused services, brute-force bots and many attacks away from your sites and data.
The word covers several different tools that work at different layers. This guide explains each type in plain language so you know which one to look at when something is blocked, or when you want more protection.
Before you start
- No technical setup is needed to read this guide.
- It helps to know what an IP address and a port are. A port is a numbered door on a server: 22 for SSH, 443 for HTTPS, 2083 for cPanel and so on. See which ports a cPanel server needs.
How a firewall decides
A firewall compares each connection with an ordered list of rules. A rule usually matches on:
- Source IP – who is connecting (for example
203.0.113.10or a whole range like203.0.113.0/24). - Destination port and protocol – what they want (TCP 443, UDP 53).
- Direction – incoming (inbound) or outgoing (outbound).
- State – whether the packet belongs to a connection that is already established.
The first matching rule wins: allow, deny/drop or reject. A good firewall uses a default deny policy: everything is blocked unless a rule allows it.
Network firewalls
A network firewall sits in front of one or many machines, at the edge of a data centre, in a router or as a cloud security group. It filters traffic before it reaches the server, so blocked packets never use the server's CPU. DDoS scrubbing at the provider level is a specialised form of network filtering; see DDoS protection basics.
Host-based firewalls
A host-based firewall runs on the server itself and protects only that machine. This is the firewall you manage on a VPS or a WHM server:
| Tool | Where you meet it |
|---|---|
| CSF + LFD | cPanel/WHM and DirectAdmin servers |
| Imunify360 firewall | cPanel servers with Imunify360 |
| firewalld | AlmaLinux, Rocky Linux, CentOS |
| UFW | Ubuntu and Debian |
| iptables / nftables | The Linux kernel engine underneath all of the above |
| Windows Defender Firewall | Windows Server and Windows VPS |
Host firewalls are often paired with a log watcher such as LFD, cPHulk or fail2ban that adds a temporary block when an IP fails to log in too many times.
Web application firewalls (WAF)
A WAF understands HTTP. Instead of looking only at IPs and ports it reads the request itself – URLs, form fields, cookies – and blocks patterns such as SQL injection, cross-site scripting or known exploit paths. Common examples:
- ModSecurity with the OWASP Core Rule Set or Imunify360 rules, running inside the web server.
- Cloudflare WAF, running at Cloudflare's edge before traffic reaches your hosting.
A WAF can protect a website on port 443 that a network or host firewall has to leave open for everyone.
Which one do you need?
- Shared or reseller hosting at MdmHost: the server firewall, brute-force protection and ModSecurity are managed for you. You can still block visitors with cPanel IP Blocker.
- VPS or dedicated server: run a host firewall with default deny, add brute-force protection, and lock down SSH or RDP.
- Busy or targeted website: add a WAF and rate limiting, for example Cloudflare WAF custom rules.
Tip: Layers add up. A network firewall reduces noise, a host firewall closes unused ports, and a WAF filters what reaches your application.
Troubleshooting
If a site, email or cPanel suddenly stops loading from one location but works from your phone's mobile data, your IP has probably been blocked by a firewall. Follow why is my IP blocked and how to get unblocked.