Firewalls Explained: Types and How to Set One Up

A firewall decides which network traffic may reach a computer or network and which may leave it. Every server on the internet needs one, from a laptop to a hosting server. This guide explains how firewalls work, the main types, how to set one up well on a server you manage, and what is already done for you on Domain India hosting.

1. What a firewall does

A firewall sits between a trusted side (your server or office network) and an untrusted side (the internet). For each packet or connection it checks a list of rules in order and either allows it, drops it silently, or rejects it with an error.

Rules usually look at:

• Source and destination IP address: who is talking to whom.
• Port and protocol: which service, for example TCP 443 for HTTPS or TCP 22 for SSH.
• Direction: inbound (from the internet to you) or outbound (from you to the internet).
• Connection state: whether a packet belongs to a connection that is already allowed.

Firewalls began in the late 1980s as simple packet filters; stateful and application-aware firewalls followed. All three ideas are still in use.

2. How firewalls inspect traffic

Two related terms come up often:

• IDS/IPS (intrusion detection or prevention system). It watches traffic for known attack patterns. An IDS only alerts; an IPS also blocks.
• Deep packet inspection (DPI). It reads the content of packets, not just the headers. It can only see inside HTTPS if the firewall decrypts it.

3. Types of firewall by where they run

A network firewall suits an office with many devices. A single server on the internet mainly needs a well-configured host-based firewall, and a WAF if it runs a website. Our guide to the web application firewall covers the WAF layer in detail.

4. The rules that matter most

5. Setting up a firewall on your own Linux server

This section applies to a VPS or server you manage yourself, not to shared hosting, where you cannot change the server firewall.

Modern Linux distributions use nftables in the kernel. Most people manage it through a friendlier front end:

• firewalld on AlmaLinux, Rocky Linux and RHEL.
• ufw on Ubuntu and Debian.

A minimal web server with ufw:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw limit 22/tcp        # SSH, rate-limited
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

The same with firewalld:

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

Two traps to know:

• Docker bypasses ufw and firewalld rules for published ports. A container started with -p 5432:5432 is reachable from the internet even if your firewall looks closed. Publish ports on 127.0.0.1 only, for example -p 127.0.0.1:5432:5432, or manage the rules in Docker's own chain.
• IPv6 needs rules too. If the server has an IPv6 address, check that your policy covers it. ufw and firewalld handle both when configured normally; hand-written rules often forget IPv6.

On Windows servers, use Windows Defender Firewall with Advanced Security, keep inbound traffic blocked by default and allow only the ports your applications need. Avoid exposing Remote Desktop (3389) to the whole internet; restrict it to known addresses or put it behind a VPN.

6. Benefits and limits

A firewall is one layer. Combine it with updates, key-based SSH, strong passwords with two-factor authentication, a WAF for websites, and tested backups. Review the rules every few months, remove anything no longer used, and after each change scan the server from outside (for example nmap -Pn yourserverip) to confirm only the intended ports answer.

7. Firewalls on Domain India hosting

Shared hosting (cPanel, DirectAdmin, Webuzo, Windows). The server firewall is configured and maintained by us for everyone on the server, and customers can't change it. When we checked on 20 September 2026, our cPanel and DirectAdmin servers ran the CSF firewall together with Imunify360, and the cPanel servers also ran Imunify360's DoS protection and a ModSecurity web application firewall. What this means for you:

• The ports customers need are open, including web, mail, FTP and the control panel. The full, measured list is in Domain India hosting port numbers.
• MySQL port 3306 is closed from outside on every shared server. Connect through an SSH tunnel instead; see how to connect to the MySQL database.
• Outgoing connections are filtered too on our cPanel and DirectAdmin servers. For example, MongoDB's port 27017 is not allowed out, so MongoDB Atlas can't be reached from shared hosting; use the App Platform, a VPS, or MySQL or PostgreSQL instead.
• Jailed SSH access is available on every Linux shared hosting plan. It is off by default; ask support to enable it. Login is by SSH key. See enabling and accessing jailed SSH.

If you think the firewall is blocking you, for example you can't reach your control panel from one network, open a ticket with your public IP address and the time it happened.

VPS. A Domain India VPS is self-managed. You get root access and set up the firewall yourself, following section 5. See the VPS security checklist for the rest of the hardening.

Prices on the cards are Domain India list prices and exclude 18% GST.

Frequently asked questions

Ready to go further? Read about the web application firewall, compare cPanel hosting and VPS plans, or open a ticket if you think a firewall rule is blocking you.