Proper firewall configuration is critical for securing Linux servers, controlling network traffic, and preventing unauthorised access.
\nLinux provides multiple tools like UFW, firewalld, and iptables; each is designed for different levels of control and flexibility.
\nThis guide walks through configuration examples for all three, based on industry best practices and real-world administration experience.<\/p>\n
UFW is a user-friendly front-end for managing firewall rules, available by default on Ubuntu and Debian-based distributions. It simplifies configuration for administrators who prefer straightforward commands.<\/p>\n
Steps to Configure UFW:<\/strong><\/p>\n The verbose flag displays detailed information about active rules and default policies.<\/li>\n You can also specify a range or protocol when necessary:<\/p>\n Pro Tip: firewalld is the default firewall management tool for CentOS, RHEL, and Fedora. It organises rules into zones<\/em> that define trust levels for different network connections.<\/p>\n Steps to Configure firewalld:<\/strong><\/p>\n This confirms whether the firewalld service is running.<\/li>\n Pro <\/a>Tip: iptables is a powerful, low-level firewall utility available on most Linux distributions. It provides granular control over network traffic and packet filtering but requires careful rule management.<\/p>\n Steps to Configure iptables:<\/strong><\/p>\n This displays all current rules along with packet and byte counters.<\/li>\n Expert <\/a>Tip: This way, configuring firewall rules in Linux is essential for protecting servers from unauthorised access and maintaining a secure network perimeter.\n
sudo ufw enable\r\nsudo ufw status verbose<\/pre>\n
sudo ufw allow 22\/tcp\u00a0\u00a0\u00a0 # Allow SSH\r\nsudo ufw allow 80\/tcp\u00a0\u00a0\u00a0 # Allow HTTP\r\nsudo ufw allow 443\/tcp\u00a0\u00a0 # Allow HTTPS\r\nsudo ufw deny 23\/tcp\u00a0\u00a0\u00a0\u00a0 # Block Telnet<\/pre>\n
sudo ufw allow 1000:2000\/tcp<\/pre>\n<\/li>\n<\/ol>\n
\n
\n
sudo ufw delete allow 80\/tcp<\/pre>\n<\/li>\n
sudo ufw reset<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n
\nBefore enabling UFW on a remote server, ensure that SSH (port 22) is allowed; otherwise, you may lose remote access.<\/p>\nfirewalld<\/strong><\/h3>\n
\n
sudo systemctl enable firewalld\r\nsudo systemctl start firewalld\r\nsudo firewall-cmd \u2013state<\/pre>\n
\n
sudo firewall-cmd --get-active-zones<\/pre>\n<\/li>\n
sudo firewall-cmd --zone=public --list-all<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n
\n
sudo firewall-cmd --zone=public --add-service=http --permanent\r\nsudo firewall-cmd --zone=public --add-service=https --permanent\r\nsudo firewall-cmd --reload<\/pre>\n<\/li>\n
sudo firewall-cmd --zone=public --remove-service=http --permanent\r\nsudo firewall-cmd --reload<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n
\nAlways use the \u2018\u2014permanent\u2019 flag for configurations you want to persist after system reboots. Without it, rules apply only until the next restart.<\/p>\niptables<\/strong><\/h3>\n
\n
sudo iptables -L -v -n<\/pre>\n
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT # Allow SSH\r\nsudo iptables -A INPUT -p tcp --dport 23 -j DROP # Block Telnet<\/pre>\n<\/li>\n
sudo iptables -A INPUT -p tcp -s 192.168.1.10 --dport 22 -j ACCEPT<\/pre>\n<\/li>\n
\n
sudo iptables -D INPUT -p tcp --dport 22 -j ACCEPT<\/pre>\n<\/li>\n
\n
sudo iptables-save > \/etc\/iptables\/rules.v4<\/pre>\n<\/li>\n
sudo service iptables save<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n
\nAlways keep console access (or recovery mode) available when editing iptables remotely; misconfigured rules can lock you out of the server.<\/p>\nBest Practices for Firewall Management<\/strong><\/h3>\n
\n
\n
sudo ufw status > ~\/ufw-backup.txt<\/pre>\n<\/li>\n
sudo iptables-save > ~\/iptables-backup.v4<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n
Conclusion<\/strong><\/h3>\n
\nBy using UFW, firewalld, or iptables according to your environment and skill level, you can effectively manage inbound and outbound traffic, reduce vulnerabilities, and maintain a strong security posture.<\/p>\n
\nA Linux VPS Hosting<\/a> solution provides full root access and the control needed to manage firewalls, services and server security.<\/div>\n