Linux Essentials Preparation · lesson 22 of 23 · 25 min
Linux Firewall Overview
Linux firewalls are built on netfilter — a kernel framework for packet filtering. User-space tools provide interfaces to configure netfilter rules.
iptables — the traditional Linux firewall tool. Powerful but complex syntax. Still widely used and important to understand.
nftables — the modern replacement for iptables. Cleaner syntax, better performance. Default on newer distributions.
ufw (Uncomplicated Firewall) — simplified frontend for iptables. Default on Ubuntu/Debian. Easy to use for common tasks.
firewalld — dynamic firewall daemon with zones. Default on RHEL/CentOS/Fedora. Managed with firewall-cmd.
ufw Commands
ufw enable / disable — enables or disables the firewall.
ufw status verbose — shows current rules and status.
ufw allow 22 — allows SSH (port 22) from anywhere.
ufw allow from 192.168.1.0/24 — allows all traffic from a subnet.
ufw deny 23 — blocks Telnet.
ufw allow 80/tcp — allows HTTP.
ufw delete allow 80 — removes a rule.
ufw default deny incoming — default policy: block all inbound. ufw default allow outgoing — allow all outbound.
ufw logging on — enables firewall logging.
iptables Basics
iptables chains: INPUT (inbound to local system), OUTPUT (outbound from local system), FORWARD (traffic passing through).
iptables tables: filter (default — packet filtering), nat (address translation), mangle (packet modification).
iptables -L -n -v — list all rules with verbose output and numeric addresses.
iptables -A INPUT -p tcp –dport 22 -j ACCEPT — append rule to allow SSH.
iptables -A INPUT -j DROP — drop all other inbound traffic (default deny).
iptables -D INPUT 3 — delete rule number 3 from INPUT chain.
iptables -F — flush (delete) all rules. iptables -P INPUT DROP — set default policy to DROP.
Rules are not persistent by default — save with iptables-save and restore with iptables-restore.
Exam Tip
ufw = Ubuntu/Debian simplified firewall. firewalld = RHEL/CentOS zone-based firewall. iptables chains: INPUT, OUTPUT, FORWARD. Default deny = block everything then allow specific ports. Rules are not persistent without saving.
Key Terms
Key Terms
Knowledge Check — 8 Questions
Linux Essentials — Firewall Management
ufw is the default firewall tool on:
- RHEL/CentOS
- Ubuntu/Debian
- Arch Linux
- Alpine Linux
- Answer: Ubuntu/Debian
ufw (Uncomplicated Firewall) is the default on Ubuntu and Debian. RHEL/CentOS uses firewalld. iptables INPUT chain handles:
- Traffic passing through the system
- Outbound traffic from the system
- Inbound traffic destined for the local system
- NAT rules
- Answer: Inbound traffic destined for the local system
INPUT = traffic coming in to the local system. OUTPUT = traffic leaving. FORWARD = traffic passing through (router). ufw default deny incoming means:
- All traffic is blocked
- All inbound traffic is blocked unless explicitly allowed
- All outbound traffic is blocked
- SSH is blocked
- Answer: All inbound traffic is blocked unless explicitly allowed
Default deny incoming = block all inbound by default. Then add allow rules for specific ports (22, 80, 443, etc.).
iptables -F does what?
- Flushes (deletes) all rules
- Saves rules to a file
- Forwards all traffic
- Sets the default policy to ACCEPT
Answer: Flushes (deletes) all rules
iptables -F flushes all rules from all chains. Be careful — if the default policy is DROP, this will block all traffic.
To allow HTTP traffic with ufw:
- ufw open 80
- ufw allow 80/tcp
- ufw permit http
- ufw add 80
- Answer: ufw allow 80/tcp
ufw allow 80/tcp allows TCP traffic on port 80. ufw allow http also works (uses service name). iptables rules are NOT persistent by default. To save them:
- systemctl save iptables
- iptables-save > /etc/iptables/rules.v4
- iptables –persist
- reboot
- Answer: iptables-save > /etc/iptables/rules.v4
iptables rules are lost on reboot. Save with iptables-save and restore with iptables-restore. Packages like iptables-persistent automate this. firewalld uses the concept of:
- Chains
- Tables
- Zones
- Profiles
- Answer: Zones
firewalld organises rules into zones (public, trusted, home, work, etc.) — each zone has different trust levels and rules.
The Linux kernel framework underlying all Linux firewalls is called _____.
Answer: netfilter
netfilter is the kernel-level packet filtering framework. iptables, nftables, ufw, and firewalld are all user-space interfaces to netfilter.
Previous lesson: SSH: key-based authentication, sshd_config hardening, port forwarding, scp, sftp
Back to Linux Essentials Preparation
Next lesson: Security tools: Fail2ban, auditd, lynis, chkrootkit, clamav — purpose and usage