Skip to main content

Chapter 9.3 - Firewall

Learning Objectives​

By the end of this chapter, you will be able to:

  • Understand Linux firewalls
  • Configure iptables
  • Use firewalld (Red Hat/CentOS)
  • Use ufw (Ubuntu/Debian)
  • Understand filtering rules
  • Secure services

Types of Firewalls​

iptables​

Low-level firewall, direct kernel control:

Features:

  • Very powerful
  • Complex
  • Direct kernel
  • Available everywhere

firewalld​

High-level firewall, simplified interface:

  • Zones (public, internal, etc.)
  • Predefined services
  • Simpler than iptables
  • Red Hat/CentOS/Fedora

ufw​

Uncomplicated Firewall, very simple:

  • Simple interface
  • Ubuntu/Debian
  • Based on iptables
  • Easy to use

iptables - Basics​

Tables​

# Main tables
# - filter: Filtering (default)
# - nat: Address translation
# - mangle: Packet modification

# View rules
sudo iptables -L -n -v

# By table
sudo iptables -t filter -L
sudo iptables -t nat -L

Chains​

Table FILTER:

  • INPUT: Incoming packets
  • OUTPUT: Outgoing packets
  • FORWARD: Routed packets

View Rules​

# Simple list
sudo iptables -L

# With numbers
sudo iptables -L --line-numbers

# Numeric (no DNS resolution)
sudo iptables -L -n

# Verbose (details)
sudo iptables -L -v

# All tables
sudo iptables -t nat -L -n -v

iptables Rules​

Add a Rule​

# Format: iptables -A CHAIN -j ACTION

# Allow SSH (port 22)
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow HTTP (port 80)
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# Allow HTTPS (port 443)
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Drop everything else
sudo iptables -A INPUT -j DROP

Insert a Rule​

# Insert at the beginning (priority)
sudo iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT

# Insert at specific position
sudo iptables -I INPUT 3 -p tcp --dport 80 -j ACCEPT

Delete a Rule​

# By number
sudo iptables -D INPUT 1

# By match
sudo iptables -D INPUT -p tcp --dport 22 -j ACCEPT

Default Policy​

# Default policy (if no rule matches)
sudo iptables -P INPUT DROP
sudo iptables -P OUTPUT ACCEPT
sudo iptables -P FORWARD DROP

iptables Examples​

Basic Configuration​

#!/bin/bash
# Basic firewall configuration

# Flush existing rules
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t nat -X

# Default policy
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

# Allow loopback
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

# Allow established connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow HTTP/HTTPS
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# ICMP (ping)
sudo iptables -A INPUT -p icmp -j ACCEPT

Save/Restore​

# Save
sudo iptables-save > /etc/iptables/rules.v4

# Restore
sudo iptables-restore < /etc/iptables/rules.v4

# Automatic on startup (Ubuntu/Debian)
sudo apt install iptables-persistent
sudo netfilter-persistent save

firewalld​

Concepts​

Zones:

  • public: Public zone (default)
  • internal: Internal network
  • trusted: Trusted
  • work: Office
  • home: Home

Basic Commands​

# Status
sudo firewall-cmd --state
sudo firewall-cmd --list-all

# Zones
sudo firewall-cmd --get-zones
sudo firewall-cmd --get-default-zone
sudo firewall-cmd --set-default-zone public

# Services
sudo firewall-cmd --get-services
sudo firewall-cmd --list-services

Add Services​

# Add service (temporary)
sudo firewall-cmd --add-service=http

# Add service (permanent)
sudo firewall-cmd --add-service=http --permanent

# Reload
sudo firewall-cmd --reload

# Verify
sudo firewall-cmd --list-services

Ports​

# Add port
sudo firewall-cmd --add-port=8080/tcp

# Permanent
sudo firewall-cmd --add-port=8080/tcp --permanent

# Remove
sudo firewall-cmd --remove-port=8080/tcp --permanent

ufw (Ubuntu/Debian)​

Activation​

# View status
sudo ufw status

# Enable
sudo ufw enable

# Disable
sudo ufw disable

Basic Rules​

# Allow SSH
sudo ufw allow 22/tcp
sudo ufw allow ssh

# Allow HTTP/HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Allow from IP
sudo ufw allow from 192.168.1.0/24

# Deny
sudo ufw deny 3306/tcp  # MySQL

# Delete rule
sudo ufw delete allow 80/tcp

View Rules​

# Numbered list
sudo ufw status numbered

# Details
sudo ufw status verbose

Reset​

# Reset all rules
sudo ufw reset

Best Practices​

Security​

# 1. Always allow SSH before enabling
sudo ufw allow ssh
sudo ufw enable

# 2. Restrictive default policy
# DROP for INPUT, ACCEPT for OUTPUT

# 3. Allow only what's necessary
# No overly broad rules

# 4. Test before saving
# Verify connectivity

# 5. Log drops
sudo iptables -A INPUT -j LOG --log-prefix "IPTABLES-DROP: "

Maintenance​

# Regularly check rules
sudo iptables -L -n -v
sudo firewall-cmd --list-all
sudo ufw status verbose

# Save configuration
sudo iptables-save > backup-$(date +%Y%m%d).rules

Summary​

In this chapter, you learned:

Types: iptables (low-level), firewalld (zones), ufw (simple)
iptables: Tables, chains, rules, policies
firewalld: Zones, services, ports, permanent
ufw: Activation, rules, status, reset
Security: Restrictive policy, allow only necessary
Practice: Basic configuration, backup, test

Next Steps​

Chapter 9.4: Security Audit and Monitoring
Module 10: Package Management

Chapter created on: December 2024