A firewall decides which packets may pass. A scrubbing center absorbs what would overwhelm it.
Firewalls enforce policy on ports, IPs and connection state. They protect against unauthorised access - but volumetric attacks fill bandwidth and state tables before rules matter.
5 min read
Packet filter: allow/deny by IP, port, protocol - fast but no session awareness.
Stateful firewall: tracks connections (iptables/nftables, hardware NGFW) - better for TCP/UDP sessions.
Application firewall / WAF: inspects HTTP headers, paths, payloads - Layer 7 policy.
Host firewall: on the server OS - last line for that machine.
Edge firewall: at network border - policy for inbound/outbound traffic.
Cloud security groups: virtual packet filters in hypervisors - common on VPS platforms.
When attack volume exceeds link capacity, packets never reach your firewall - the transit pipe saturates first.
Scrubbing centers with large capacity filter upstream. Firewalls remain essential for policy after clean traffic is delivered.
Combine both: upstream DDoS protection + tight host/edge firewall rules on allowed ports only.
A WAF is an application-layer firewall focused on HTTP/HTTPS. It does not stop multi-gigabit UDP floods.
No - default deny inbound, allow only required services. Document game, panel and admin ports explicitly.
TMW Shield handles volume; you keep granular firewall rules on clean delivery.