A firewall is not a security strategy
People treat a packet filter as the answer to "is this box secure". It is closer to the answer for "is this box exposed". Those are different questions, and confusing them is how you end up with a host that passes every port scan and still gets owned.
What a firewall actually does
It decides which packets reach a listening socket. That is the whole job. If a service
is listening on 0.0.0.0 and you rely on the firewall to keep it private,
you have one misconfiguration — a rule reloaded from the wrong file, a container that
bypasses the host chain, a cloud security group that disagrees — between that service
and the internet.
Defense in depth means the service itself should also bind to where it belongs.
The three places rules are not
On a typical cloud instance there are at least three independent layers:
- The provider's security list or security group
- The host's own
iptables/nftables - Whatever the application or container runtime does on its own
They fail independently, and they fail silently. I have spent an afternoon on a port that was open in two layers and blocked in the third. Testing from outside the network is the only check that tells you the truth.
What actually improves security posture
In rough order of value: fewer listening services, patched software, unique credentials per service, least privilege for anything that runs code, and logs someone reads. The firewall sits somewhere below all of those. Useful, necessary, insufficient.
The uncomfortable part is that most of the list above is not a configuration change. It is a habit.