Hardware vs software firewall
A hardware firewall filters packets at the network edge before they reach your server, while a software firewall such as UFW, firewalld or Windows Defender Firewall runs on the server and controls its own ports. Production servers need both, because each sees traffic the other misses. A web application firewall adds HTTP inspection on top.
For VPS and dedicated-server owners deciding which firewall layers they need and how to configure the one on their own server.
knowledge
- Read time
- 4 min
- Sections
- 5
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
What is the difference between a hardware firewall and a software firewall?
A hardware (network) firewall filters traffic at the network edge before it reaches your server; a software (host) firewall runs on the server itself and controls which of its ports accept connections. They see different traffic, so production servers normally use both.
| Attribute | Hardware / network firewall | Software / host firewall | Web application firewall (WAF) |
|---|---|---|---|
| Where it runs | Appliance or router filter in front of servers; cloud "security groups" | On the VPS or server OS | Reverse proxy, CDN or web-server module |
| Layer | Network and transport (L3/L4) | Network and transport, per host | Application (HTTP, L7) |
| Examples | Data-centre edge filters, Fortinet or Palo Alto appliances | UFW, firewalld, CSF, Windows Defender Firewall | ModSecurity, Cloudflare WAF |
| Stops | Closed-port scans, floods, management ports exposed to the internet | Unwanted services on that machine, SSH from unknown IPs | SQL injection, XSS, bad bots in allowed web traffic |
| Blind to | Malicious content inside allowed HTTPS | Traffic large enough to fill the uplink before it arrives | Non-HTTP ports |
None of the three replaces software updates, unique passwords or a restorable backup; a firewall decides who may connect, not whether the application behind it is safe.
What does a network hardware firewall protect against?
A network firewall drops unwanted packets before they consume the server's CPU or bandwidth, which makes it the right layer for closing management ports and absorbing network-level floods. Most are stateful: they track connections and allow replies to traffic the server started.
- Publish only what visitors need: ports 80 and 443 for a website; never the database port (3306 or 5432).
- Restrict administration: SSH (22) or Remote Desktop (3389) only from office or VPN addresses.
- Absorb floods upstream: a guest firewall cannot add bandwidth that the uplink does not have.
Volumetric attacks measured in gigabits need filtering before the server; WebJi® includes network-edge filtering on hosting plans, and larger scrubbing work is quoted through the DDoS protection service.
How does a software firewall work on a Linux VPS?
On Linux, host firewalls such as UFW, firewalld and CSF are front ends to the kernel's netfilter packet filter (nftables or iptables), applying an allow list to that one machine. They remain your last line when an upstream rule is too broad.
# Ubuntu / Debian with UFW: allow SSH first, then enable
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw enable
sudo ufw status verbose
# AlmaLinux / Rocky with firewalld
sudo firewall-cmd --permanent --add-service=http --add-service=https
sudo firewall-cmd --reload
sudo firewall-cmd --list-allAlways allow SSH before running ufw enable on a remote server, or you will lock yourself out. sudo ufw limit OpenSSH adds rate limiting that slows brute-force attempts.
CSF (ConfigServer Security & Firewall) is common beside cPanel and adds login-failure blocking; setup is in the CSF install guide. For repeated SSH guessing, pair the firewall with Fail2Ban.
How do you configure the software firewall on a Windows server?
Windows Server uses Windows Defender Firewall with Advanced Security, which you can manage in its console or with PowerShell's NetSecurity cmdlets. The most important rule on an internet-facing Windows VPS is restricting Remote Desktop.
# allow RDP only from one office IP (replace the address)
New-NetFirewallRule -DisplayName "RDP from office" -Direction Inbound `
-Protocol TCP -LocalPort 3389 -RemoteAddress 203.0.113.10 -Action Allow
# allow web traffic
New-NetFirewallRule -DisplayName "Web 80-443" -Direction Inbound `
-Protocol TCP -LocalPort 80,443 -Action AllowThen disable or narrow the built-in "Remote Desktop" rules that allow any address. A Windows VPS exposed to the whole internet on port 3389 attracts constant password guessing.
Which host firewall mistakes leave servers exposed?
The common mistakes are Docker bypassing UFW, rules saved only in memory, database ports opened "just to test", and two firewall tools fighting over the same rules. Each leaves a port open that the admin believes is closed.
- Docker and UFW: ports published with
docker run -pare added by Docker's own iptables rules and can bypass UFW; bind containers to127.0.0.1or filter in the DOCKER-USER chain. - Non-persistent rules: firewalld changes without
--permanentdisappear on reload or reboot. - Temporary openings: a MySQL port opened for one test and never closed is a frequent breach route.
- Mixed tools: run one of UFW, firewalld or CSF on a host, not two at once.
Verify from outside the server, for example nc -zv your-server-ip 3306 from another machine, rather than trusting the rule list. Disabling a firewall for troubleshooting is covered, with its risks, in disabling the firewall on Linux.
Where does a web application firewall fit?
A WAF inspects the HTTP requests that both network and host firewalls must allow through on port 443, blocking attack patterns such as SQL injection and cross-site scripting. It works at a different layer, so it complements rather than replaces either firewall.
A WAF needs tuning: rules that are too broad block real customers' form submissions or payment callbacks. Rule sets, false positives and placement are explained in what a WAF is. For a site that has already been attacked, WebJi® website security services handle clean-up and hardening.
Frequently asked questions
Is a software firewall enough for a small VPS?
For a small site it is the essential minimum: allow 80 and 443, restrict SSH, and keep the system patched. It cannot stop a flood that fills the network link, which is why the provider's edge filtering still matters even when you never configure it yourself.
Do I need a firewall on shared hosting?
No. On shared hosting the provider manages the server and network firewalls, and you have no root access to change them. Your job is application security: updates, strong passwords, and a security plugin or WAF for WordPress.
Are cloud security groups hardware or software firewalls?
They act like a network firewall: rules are enforced by the provider's virtual network before traffic reaches the instance. They are configured as software, but from the server's point of view they sit in front of it, like an edge appliance.
Should I change the SSH port instead of using a firewall?
A non-standard port reduces log noise from automated scans, but it is not access control. Restricting SSH to known addresses, using key-based login and adding Fail2Ban protect the server; a port change is at most an extra layer.
Commands checked against Ubuntu UFW, firewalld and Microsoft NetSecurity documentation · Reviewed by the WebJi® team, Jaipur.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.