What is a Firewall and How It Protects Networks from Cyber Attacks

Every device or local network connected to the internet is exposed to scanning and unauthorized access attempts by automated bots and malicious actors. A Firewall serves as the first line of defense—a security boundary that monitors and filters incoming and outgoing network traffic based on predetermined security rules.

How a Firewall Works

A firewall inspects every network packet attempting to cross the boundary and decides, based on defined policies, whether to ALLOW or BLOCK/DROP the packet.

Core Traffic Filtering Rules

Firewalls analyze data packets based on specific parameters contained in network packet headers.

1. Source and Destination IP: Blocking incoming traffic from blacklisted or unauthorized IP addresses.
2. Port Number: Permitting traffic only on essential ports (e.g., port 80/443 for web services and port 22 for SSH).
3. Network Protocol: Filtering based on protocol parameters (TCP, UDP, ICMP).

Example of Configuring a Firewall in Linux (UFW)

On Linux servers, UFW (Uncomplicated Firewall) is widely used to manage iptables filtering rules easily.

# 1. Deny all incoming traffic by default and allow outgoing traffic
sudo ufw default deny incoming
sudo ufw default allow outgoing

# 2. Allow secure SSH management traffic on port 22
sudo ufw allow 22/tcp

# 3. Allow web traffic for HTTP (80) and HTTPS (443)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# 4. Enable the firewall and check status
sudo ufw enable
sudo ufw status verbose

Why a Firewall is Mandatory for Every Server

Without an active firewall, all services listening on open ports (such as exposed development databases or test services) are directly visible to the public internet. A properly configured firewall seals unnecessary entry points, minimizing the attack surface of the system.