A machine connected to a network can be reached by anyone who can send it packets, including attackers scanning for open ports. A firewall applies rules to allow only the traffic you intend, like opening port 443 on a web server while blocking database ports from the internet. You will set such rules in cloud security groups and Linux servers. A firewall does not fix vulnerable code; an allowed request can still carry an attack, which is where a WAF helps.