What is a firewall and how to protect the ports of a Linux server

Published on 2026-10-20 by frfrand

Aprendé qué filtra un firewall, cómo usar UFW sin perder el acceso SSH y por qué abrir solo los puertos necesarios reduce riesgos.

A firewall is a mechanism that allows or blocks network traffic according to defined rules. On a Linux server it is used to reduce which services remain accessible from the Internet or from a private network. It does not eliminate application vulnerabilities, but it limits an important part of the attack surface.

If your VPS hosts a website, a database, and an internal panel, you probably do not want anyone to be able to connect directly to all three. The firewall helps establish that difference.

What does a firewall check?

Rules can take into account source or destination IP addresses, protocols such as TCP and UDP, ports, and connection state. Some more advanced products inspect additional information, but not all firewalls understand the content of a web request.

In Linux, the kernel's Netfilter subsystem participates in filtering. Tools such as nftables or iptables allow managing rules, while ufw offers a simpler interface for common tasks.

Think of it as a building's reception: it can decide who enters through which door. That does not guarantee that an authorized person will never do something improper inside.

A concrete example with three services

Imagine that you have:

• Nginx listening on ports 80 and 443 for the public website.
• SSH listening on port 22 for administration.
• PostgreSQL listening on port 5432 for the application.

A reasonable configuration might allow 80 and 443 from the Internet, restrict SSH to an administrative network, and prevent PostgreSQL from being publicly accessible. The application and the database can communicate over a local interface or private network.

The exact decision depends on your architecture. Do not copy a port list from another project without understanding which ones you need.

How to check the firewall status with UFW?

On Ubuntu Server, UFW is usually available as a simple administration tool. First, inspect the status:

sudo ufw status verbose

If the firewall appears inactive, do not enable it blindly while connected via SSH. You could block your own access if there is no appropriate rule.

Before changing anything, check the actual SSH port, your administration route, the provider's rules, and whether you have a recovery console available.

An example of rules, not a universal recipe

For a server with SSH on the standard port and a public web server, these commands illustrate the concept:

sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw status numbered

Only after verifying access and the environment could you consider enabling UFW with sudo ufw enable. If you administer SSH from a fixed IP, it is preferable to study a rule that limits the source, for example sudo ufw allow from 203.0.113.10 to any port 22 proto tcp (that address is only a documentation example, not your real IP).

A common mistake is allowing 22/tcp from the entire Internet because it is convenient and forgetting to check who needs that access.

What about Docker and published ports?

Containers add a layer of networking and rules that can modify how traffic is exposed. Depending on the configuration, publishing a Docker port can interact with firewall rules in unexpected ways.

Do not assume that UFW alone will restrict all ports published by containers. Check your container engine documentation, test from another machine, and verify which interfaces are listening.

For an internal application, it is usually better to bind the service to a private interface or to localhost and publish it only through the appropriate proxy.

Server firewall and provider firewall

A VPS can have rules at several layers: within the operating system, in the provider's infrastructure, and in an ingress load balancer or proxy.

These layers can complement each other, but they can also complicate diagnosis. If a connection fails, check the service, its listening interface, host rules, and external rules. A port allowed in UFW is not necessarily accessible if another firewall blocks it.

Does a firewall prevent DDoS attacks or SQL injection?

Not by itself. A host firewall can filter connections, but a volumetric attack can saturate the link before traffic reaches the server. For that, upstream network defenses are usually needed.

It also does not automatically detect a malicious SQL query within an allowed HTTPS request. Application security requires validations, parameterized queries, access controls, and other measures.

You can expand on this topic with what is a DDoS attack and why it is not advisable to use root for everything.

A defensive check worth repeating

After every major deployment, check which services are listening, on which interfaces, and which ports remain exposed. On Linux, ss -tulpen can help you inspect sockets, although to verify external accessibility you need a test from another authorized location.

Document essential ports and remove rules that are no longer used. A well-configured firewall is one that reflects actual services, not a collection of accumulated exceptions.

And at ArduMaker?

When hosting an application on an ArduMaker VPS, it is still necessary to define which ports should be public and which should remain on private networks. Managing a deployment from a platform does not replace reviewing network access for the system and each service.

In short: start by identifying the services that must receive traffic, allow only necessary accesses, and check the rules without losing the administration connection.

Official sources: Firewall on Ubuntu Server · Netfilter in Ubuntu documentation · Docker networks and port publishing.