Skip to main content

Firewall and security

Table of contents​

  1. Introduction to Linux firewalls
  2. UFW (Uncomplicated Firewall)
  3. firewalld (RedHat/CentOS)
  4. iptables: basics
  5. Common rules
  6. Hands-on exercises

1 - Introduction to Linux firewalls​

What is a firewall?​

A firewall controls incoming and outgoing network traffic according to defined rules.

Linux architecture​

LayerDescription
UFW/firewalldSimple user interface
iptables/nftablesConfiguration tool
NetfilterKernel module (actual filter)

Key concepts​

TermDescription
INPUTIncoming traffic to the server
OUTPUTOutgoing traffic from the server
FORWARDTraffic passing through (router)
ACCEPTAllow
DROPSilently discard
REJECTRefuse with a message

🔝 Back to table of contents​


2 - UFW (Uncomplicated Firewall)​

UFW is the simplified interface for Ubuntu/Debian.

Installation and activation​

# Installer
sudo apt install ufw

# Vérifier le statut
sudo ufw status

# Activer
sudo ufw enable

# Désactiver
sudo ufw disable

Default rules​

# Bloquer tout le trafic entrant
sudo ufw default deny incoming

# Autoriser tout le trafic sortant
sudo ufw default allow outgoing

Allow services/ports​

# Par nom de service
sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https

# Par numéro de port
sudo ufw allow 22
sudo ufw allow 80
sudo ufw allow 443

# Port TCP spécifique
sudo ufw allow 3000/tcp

# Port UDP
sudo ufw allow 53/udp

# Plage de ports
sudo ufw allow 8000:8100/tcp

Allow from an IP​

# Autoriser une IP spécifique
sudo ufw allow from 192.168.1.100

# Autoriser un réseau
sudo ufw allow from 192.168.1.0/24

# IP spécifique vers un port spécifique
sudo ufw allow from 192.168.1.100 to any port 22

# IP vers port avec protocole
sudo ufw allow from 192.168.1.100 to any port 3306 proto tcp

Block / Delete rules​

# Bloquer une IP
sudo ufw deny from 203.0.113.5

# Lister les règles avec numéros
sudo ufw status numbered

# Supprimer une règle par numéro
sudo ufw delete 3

# Supprimer une règle explicitement
sudo ufw delete allow 80

Display the status​

# Statut simple
sudo ufw status

# Statut détaillé
sudo ufw status verbose

# Avec numéros
sudo ufw status numbered

Example output:

Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere
22/tcp (v6)                ALLOW       Anywhere (v6)
Important

Always allow SSH BEFORE enabling the firewall so you don't lose access!

sudo ufw allow ssh
sudo ufw enable

🔝 Back to table of contents​


3 - firewalld (RedHat/CentOS)​

firewalld is the default firewall on RHEL/CentOS/Fedora.

Concepts​

firewalld uses zones to group rules:

ZoneUsage
dropBlock everything
publicPublic networks (default)
workWork network
homeHome network
trustedAllow everything

Basic commands​

# Statut
sudo firewall-cmd --state

# Zone par défaut
sudo firewall-cmd --get-default-zone

# Zones actives
sudo firewall-cmd --get-active-zones

# Lister les règles
sudo firewall-cmd --list-all

Manage services​

# Autoriser un service
sudo firewall-cmd --add-service=http
sudo firewall-cmd --add-service=https

# Rendre permanent
sudo firewall-cmd --add-service=http --permanent

# Ou recharger après modifications
sudo firewall-cmd --reload

# Supprimer un service
sudo firewall-cmd --remove-service=http --permanent

Manage ports​

# Ouvrir un port
sudo firewall-cmd --add-port=3000/tcp --permanent

# Supprimer un port
sudo firewall-cmd --remove-port=3000/tcp --permanent

# Recharger
sudo firewall-cmd --reload

🔝 Back to table of contents​


4 - iptables: basics​

iptables is the low-level tool for configuring Netfilter.

Structure​

Main tables​

TableUsage
filterFiltering (default)
natAddress translation
manglePacket modification

filter chains​

ChainUsage
INPUTIncoming packets
OUTPUTOutgoing packets
FORWARDRouted packets

Basic commands​

# Lister les règles
sudo iptables -L -n -v

# Lister avec numéros de ligne
sudo iptables -L --line-numbers

# Politique par défaut
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

# Autoriser le loopback
sudo iptables -A INPUT -i lo -j ACCEPT

# Autoriser les connexions établies
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Autoriser SSH
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Autoriser HTTP/HTTPS
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Supprimer une règle par numéro
sudo iptables -D INPUT 3

# Supprimer toutes les règles
sudo iptables -F

Save the rules​

# Debian/Ubuntu
sudo iptables-save > /etc/iptables/rules.v4

# Restaurer
sudo iptables-restore < /etc/iptables/rules.v4

# Avec iptables-persistent
sudo apt install iptables-persistent
sudo netfilter-persistent save
tip

Prefer UFW or firewalld for daily management. iptables is more complex but offers more control.

🔝 Back to table of contents​


5 - Common rules​

Web server​

# UFW
sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https
sudo ufw enable

Server with a database​

# MySQL accessible uniquement depuis le réseau local
sudo ufw allow from 192.168.1.0/24 to any port 3306

# PostgreSQL
sudo ufw allow from 192.168.1.0/24 to any port 5432

Block a malicious IP​

# UFW
sudo ufw deny from 203.0.113.5

# iptables
sudo iptables -I INPUT -s 203.0.113.5 -j DROP

SSH rate limiting (brute-force protection)​

# UFW
sudo ufw limit ssh

# iptables
sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

Typical server configuration​

#!/bin/bash
# Configuration pare-feu basique

# Reset
sudo ufw reset

# Défauts
sudo ufw default deny incoming
sudo ufw default allow outgoing

# SSH (limité)
sudo ufw limit ssh

# Web
sudo ufw allow http
sudo ufw allow https

# Activer
sudo ufw enable

# Vérifier
sudo ufw status verbose

🔝 Back to table of contents​


6 - Hands-on exercises​

Exercise 1: Basic UFW configuration​

# 1. Vérifiez le statut actuel
sudo ufw status

# 2. Définissez les règles par défaut
sudo ufw default deny incoming
sudo ufw default allow outgoing

# 3. Autorisez SSH (important !)
sudo ufw allow ssh

# 4. Activez le pare-feu
sudo ufw enable

# 5. Vérifiez
sudo ufw status verbose

Exercise 2: Add rules​

# 1. Autorisez HTTP et HTTPS
sudo ufw allow http
sudo ufw allow https

# 2. Autorisez un port personnalisé (ex: 3000)
sudo ufw allow 3000/tcp

# 3. Listez les règles
sudo ufw status numbered

# 4. Supprimez la règle du port 3000
sudo ufw delete allow 3000/tcp

Exercise 3: Rule by IP​

# 1. Autorisez SSH seulement depuis votre IP (remplacez)
sudo ufw allow from VOTRE_IP to any port 22

# 2. Vérifiez
sudo ufw status

Quiz​

Q1. Which command enables UFW?

Answer

sudo ufw enable

Q2. What should you always do before enabling the firewall?

Answer

Allow SSH (sudo ufw allow ssh) so you don't lose access!

Q3. What is the difference between DROP and REJECT?

Answer

DROP silently discards the packet, REJECT sends an error response.

🔝 Back to table of contents​


Key takeaways​

  • UFW = simple interface for Ubuntu/Debian
  • firewalld = RedHat/CentOS firewall
  • iptables = low-level control
  • Always allow SSH before enabling the firewall
  • Default policy: deny incoming, allow outgoing
  • ufw limit ssh for brute-force protection
  • Save the iptables rules with iptables-save

🔝 Back to table of contents​

← Previous chapter | Next chapter: Scheduled tasks →