I read that firewalls do not always work well in a virtual environment; how can that be true? If it is, how do you protect a VPS server?

I would say that it is untrue.

To protect VPS server, every web host have their security patches so there is no issue whether firewall is installed or not. In terms of extra security you should opt software firewall on your VPS account.

Depends on the firewall and the kernel you're using, but most software firewalls will operate just fine on a VPS server as long as you select the right options.

Some firewalls had issues using monolithic kernels but almost all software firewalls out there have instructions for the particular OS you're running.

The two that I use daily are APF/BFD and CSF/LFD

These work without any issue on a VPS machine. These are software firewalls.

CSF/LFD should not have any issues and is recommended.

CSF/LDF Should be fine.

Consider securing your PHP, this is a must on a VPS, it can be attacked a lot easier and there are more ways to break into a VPS, so it is a must to secure it.

Other then compromising the host node, how do you feel there are more ways?

Depends on the virtualization
xen/KVM no issues (as long as you install iptables & associated modules as needed) you the user control this so there is no issue

Open VZ some issues and if the host does not set up the node correctly
Virtuozzo some minor issues if using the old UBC instead of SLM and again if the host does not set up the node correctly

but overall firewalls should run just fine

OpenVZ is a filebase virtualization and the firewall setting in fact most depends on the host node compare to Xen VPS which is more isolated environment, so it shouldn't have any issue.

Yes, it depends on virtual machine installed, but mostly it's ok

It shouldn't have any issue, as mentioned CSF would work great as well!

As someone who specializes in VPS security is our main concern. We take a proactive approach and we actually try and find vulnerabilities, sometimes we do and we resolve them and look for more. It is a computer and no matter what someone out there is going to look for openings in your security and they will exploit them if they can.

But as mentioned above VPS servers give you great flexibility to try things. Remember ask questions, have fun experiment you might learn something.

The only problem you you might have with Virtuozo is a incompatability with ip_conntrack which will affect your ftp clients with the firewall up, but you can configure FTP to use a range of ports, which you can configure the firewall to allow.

Firewall is just another step to increase security, but it does not secure your vps/dedicated server 100%. You should take further steps and install RootKit Hunter, secure ssh, etc. There are many guides just google.

Running a firewall should be an issue unless your VPS provider has not configured the host node correctly.

To run a firewall in a VPS you need to have certain modules loaded on the host node.

Here is some good info on it from CSF forums
http://forum.configserver.com/viewtopic.php?t=212
http://forum.configserver.com/viewto...84&postcount=6

Firewalls should be fine on any server, dedicated or VPS.

As others have suggested, CSF is highly recommended. I can't say anything higher than that it is used on all of our servers.