Security & Compliance
Firewall
A filter that controls which network traffic can reach your server, blocking everything except the ports and sources you allow.
A firewall decides what traffic reaches your server and what gets dropped. The safe default is to deny everything, then open only the specific ports you need: usually 443 for HTTPS, maybe 22 for SSH from your own address. Everything else stays closed, which shrinks the surface an attacker can even attempt to touch.
Cloud firewalls come in two forms worth knowing. The provider's network firewall, DigitalOcean's Cloud Firewalls, Vultr's and Hetzner's equivalents, filters traffic before it even reaches your instance, and it's free and easy to manage. The host-level firewall like ufw or iptables runs on the server itself as a second layer. Running both is normal and sensible.
The single most common security mistake a firewall prevents is leaving a database port open to the internet. A Postgres or Redis instance reachable from anywhere gets found and attacked within hours. Bind internal services to a private network and let the firewall block the rest.
Go deeper
- Cloud Hosting Security: What's Your Job vs the Provider'sThe shared responsibility model, and the specific things people forget to configure.