How to Configure Firewall Rules in Linux (UFW, firewalld, iptables)

A Linux firewall controls which network traffic a server accepts. Use the firewall manager already responsible for the server’s rules; UFW, firewalld and direct iptables commands are different approaches, not three steps to apply together.

UFW (Uncomplicated Firewall)

Check the current rules:

sudo ufw status verbose

Before enabling an approved UFW configuration on a remote server, add the required administration rule. For an example server using SSH on port 22:

sudo ufw allow 22/tcp

Use the real port and the intended source restriction for your server. Add other required rules, then run sudo ufw enable only after reviewing the full policy. To permit an approved HTTPS service, use sudo ufw allow 443/tcp; remove that rule with sudo ufw delete allow 443/tcp when no longer required.

firewalld

Inspect the running daemon and active zone:

sudo firewall-cmd --state
sudo firewall-cmd --get-active-zones

Replace public below with the relevant zone. Add an approved HTTPS service to runtime rules, test it, then save the same rule permanently:

sudo firewall-cmd --zone=public --add-service=https
sudo firewall-cmd --permanent --zone=public --add-service=https

A reload replaces runtime rules with permanent rules. Review both before reloading; a permanent rule alone does not immediately change runtime access.

iptables

On a server intentionally using direct iptables management, inspect rule order and counters:

sudo iptables -L -n -v --line-numbers

Rules are evaluated in order. Appending an allow rule after an earlier matching drop rule may not permit access. Do not paste a standalone rule without inspecting the existing chains, policies and connection-state handling. Direct IPv4 rules also do not cover IPv6.

Capture the current rules for review with:

sudo iptables-save | sudo tee /root/iptables-before.v4 > /dev/null

This saves a snapshot; it does not install a boot-time restore mechanism. Persistence depends on the distribution and configured manager. Current systems may use nftables underneath or instead of iptables.

Best practices for firewall management

Permit only required services, test access from the intended networks and check the provider firewall too. Keep configuration backups and a recovery plan. A text listing of UFW status is useful evidence, but not a complete restorable configuration backup.