Firewall basics (ufw, iptables) in Linux CLI - Deep Dive

Overview - Firewall basics (ufw, iptables)

What is it?

A firewall is a security tool that controls which network traffic can enter or leave a computer. UFW and iptables are two common tools on Linux that help set rules to allow or block this traffic. UFW is designed to be simple and user-friendly, while iptables offers detailed control for advanced users. Both help protect your system from unwanted access and attacks.

Why it matters

Without a firewall, your computer is like an open door to the internet, vulnerable to hackers and unwanted connections. Firewalls help keep your data safe by deciding who can talk to your computer and who cannot. They are essential for personal computers, servers, and any device connected to a network to prevent damage and data theft.

Where it fits

Before learning firewalls, you should understand basic networking concepts like IP addresses and ports. After mastering firewall basics, you can explore advanced network security, intrusion detection systems, and VPNs to further protect your systems.

Mental Model

Core Idea

A firewall acts like a gatekeeper that checks every network message and decides if it can pass based on rules you set.

Think of it like...

Imagine a security guard at a building entrance who checks each visitor's ID and purpose before letting them in or out. The guard follows a list of rules about who is allowed and who is not.

┌───────────────┐
│ Incoming Data │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│   Firewall    │
│ (Rule Checker)│
└──────┬────────┘
       │
  ┌────┴─────┐
  │ Allowed  │
  └──────────┘

Rules example:
- Allow port 80 (web)
- Block port 23 (telnet)
- Allow IP 192.168.1.5
- Block all others

Build-Up - 7 Steps

1

Foundation

What is a Firewall and Why Use It

Concept: Introduce the basic idea of a firewall and its purpose in network security.

A firewall is like a filter for your computer's network. It watches all the data coming in and going out and decides what is safe. Without it, anyone could connect to your computer and cause harm. Firewalls help keep your computer safe by blocking bad connections and allowing good ones.

Result

You understand that a firewall protects your computer by controlling network traffic.

Knowing the firewall's role helps you see why controlling network access is crucial for security.

2

Foundation

Basic Network Concepts for Firewalls

Concept: Explain IP addresses, ports, and protocols as the building blocks firewalls use to filter traffic.

Every device on a network has an IP address, like a home address for sending data. Ports are like doors on that device, each used for different services (like web or email). Protocols are rules for how data moves. Firewalls use these details to decide which traffic to allow or block.

Result

You can identify IP addresses, ports, and protocols as key elements in firewall rules.

Understanding these basics is essential because firewall rules are built around them.

3

Intermediate

Using UFW for Simple Firewall Rules

🤔Before reading on: do you think UFW commands require complex syntax or are they simple to use? Commit to your answer.

Concept: Introduce UFW as an easy tool to manage firewall rules with simple commands.

UFW stands for Uncomplicated Firewall. It lets you allow or block traffic with simple commands like 'ufw allow 22' to let in SSH connections. You can enable or disable the firewall easily. UFW hides the complex details of iptables but still protects your system.

Result

Commands like 'ufw allow 80' open web traffic, and 'ufw deny 23' blocks telnet traffic.

Knowing UFW simplifies firewall management helps beginners protect systems without deep technical knowledge.

4

Intermediate

Understanding iptables for Detailed Control

🤔Before reading on: do you think iptables rules are easier or more complex than UFW? Commit to your answer.

Concept: Explain iptables as a powerful tool that controls network traffic with detailed rules and chains.

iptables works by organizing rules into chains like INPUT (incoming), OUTPUT (outgoing), and FORWARD (passing through). Each rule matches certain traffic and decides to ACCEPT, DROP, or REJECT it. You can write very specific rules, like blocking a single IP or allowing only certain ports.

Result

You can create rules like 'iptables -A INPUT -p tcp --dport 22 -j ACCEPT' to allow SSH traffic.

Understanding iptables chains and actions is key to mastering advanced firewall setups.

5

Intermediate

How UFW Uses iptables Behind the Scenes

Concept: Show that UFW is a user-friendly front for iptables, translating simple commands into complex rules.

When you use UFW commands, it creates iptables rules automatically. This means UFW is easier to use but still powerful because iptables is doing the actual filtering. You can see iptables rules with 'sudo iptables -L' even after using UFW.

Result

UFW commands result in iptables rules that enforce your firewall settings.

Knowing this connection helps you troubleshoot and understand what happens when you use UFW.

6

Advanced

Writing Custom iptables Rules for Complex Needs

🤔Before reading on: do you think iptables can filter traffic based on time or connection state? Commit to your answer.

Concept: Introduce advanced iptables features like stateful filtering and time-based rules.

iptables can track connection states like NEW, ESTABLISHED, or RELATED to allow only valid traffic. You can also write rules that apply only at certain times or days. For example, blocking SSH access outside work hours. This level of control helps secure servers in complex environments.

Result

Rules like 'iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT' allow only new and established SSH connections.

Understanding stateful filtering prevents common security holes and improves firewall effectiveness.

7

Expert

Common Pitfalls and Best Practices in Firewalls

🤔Before reading on: do you think allowing all outgoing traffic is always safe? Commit to your answer.

Concept: Discuss common mistakes like overly open rules and how to avoid them for secure firewall setups.

Many users allow all outgoing traffic by default, which can let malware communicate out unnoticed. It's better to restrict outgoing connections to only needed services. Also, stacking many iptables rules without order can cause conflicts. Experts carefully plan rule order and test changes to avoid locking themselves out.

Result

A secure firewall blocks unnecessary traffic both in and out, reducing attack surface.

Knowing these pitfalls helps maintain strong security and avoid accidental exposure.

Under the Hood

Firewalls work by inspecting each network packet against a list of rules. iptables operates at the Linux kernel level, hooking into the network stack to filter packets before they reach applications. It uses chains and tables to organize rules for different packet types and directions. UFW is a front-end that generates iptables rules, simplifying user interaction but relying on the same kernel mechanisms.

Why designed this way?

iptables was designed to provide flexible, low-level control over network traffic in Linux, allowing administrators to build complex security policies. UFW was created later to make firewall management accessible to less technical users by abstracting iptables complexity. This separation balances power and usability.

┌───────────────┐
│ Network Packet│
└──────┬────────┘
       │
       ▼
┌───────────────┐
│  Netfilter    │  <-- Linux kernel module
│ (iptables)   │
└──────┬────────┘
       │
┌──────┴───────┐
│  Chains &    │
│  Rules      │
└──────┬───────┘
       │
┌──────┴───────┐
│ ACCEPT/DROP  │
│ or REJECT    │
└──────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does enabling UFW automatically block all incoming and outgoing traffic? Commit to yes or no.

Common Belief: Turning on UFW blocks all network traffic by default.

Reality: By default, UFW blocks incoming traffic but allows all outgoing traffic.

Why it matters: Assuming all traffic is blocked can lead to false security confidence and overlooked outgoing threats.

Quick: Can iptables rules be applied in any order without affecting behavior? Commit to yes or no.

Common Belief: The order of iptables rules does not matter; all rules are checked equally.

Reality: iptables processes rules in order, and the first matching rule decides the fate of the packet.

Why it matters: Ignoring rule order can cause unexpected behavior and security holes.

Quick: Does UFW replace iptables completely? Commit to yes or no.

Common Belief: UFW is a separate firewall and replaces iptables functionality.

Reality: UFW is a front-end that manages iptables rules; iptables is still the underlying firewall engine.

Why it matters: Misunderstanding this can confuse troubleshooting and advanced configuration.

Quick: Can a firewall protect against all types of cyber attacks? Commit to yes or no.

Common Belief: A firewall alone can stop all cyber threats and attacks.

Reality: Firewalls protect network access but cannot stop attacks like malware inside the system or phishing.

Why it matters: Overreliance on firewalls can lead to neglecting other important security measures.

Expert Zone

1

iptables rules can be optimized by combining matches to reduce processing time and avoid rule conflicts.

2

UFW allows custom iptables rules to be added, blending simplicity with advanced control when needed.

3

Stateful filtering in iptables tracks connection states, which is crucial for allowing legitimate traffic while blocking attacks.

When NOT to use

For very high-performance or specialized network environments, hardware firewalls or dedicated security appliances may be better. Also, for complex distributed systems, software firewalls alone are insufficient; consider network segmentation and intrusion detection systems.

Production Patterns

In production, UFW is often used on simple servers for quick setup, while iptables scripts or firewall management tools like nftables or firewalld handle complex policies. Automated deployment scripts ensure consistent firewall rules across many servers.

Connections

Access Control Lists (ACLs)

Both firewalls and ACLs control access by filtering requests based on rules.

Understanding firewall rules helps grasp ACLs in systems like routers or cloud services, as they share the same filtering principles.

Human Immune System

Firewalls act like the immune system by identifying and blocking harmful invaders while allowing safe elements.

Seeing firewalls as a biological defense helps appreciate the balance between protection and allowing normal activity.

Traffic Lights in Road Networks

Firewalls regulate data flow like traffic lights control vehicle movement to prevent accidents and congestion.

This connection clarifies how timing and rules in firewalls prevent network chaos and collisions.

Common Pitfalls

#1 Allowing all outgoing traffic without restrictions.

Wrong approach:

ufw default allow outgoing
ufw enable

Correct approach:

ufw default deny outgoing
ufw allow out 80/tcp
ufw allow out 443/tcp
ufw enable

Root cause:

Assuming outgoing traffic is always safe and forgetting that malware can use it to communicate.

#2 Writing iptables rules without considering rule order.

Wrong approach:

iptables -A INPUT -j DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Correct approach:

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP

Root cause:

Not knowing iptables stops checking after the first matching rule.

#3 Disabling UFW but forgetting iptables rules remain active.

Wrong approach:

ufw disable
# assume firewall is off

Correct approach:

ufw disable
iptables -F
# flush iptables rules to fully disable firewall

Root cause:

Believing UFW controls all firewall rules without realizing iptables rules persist separately.

Key Takeaways

Firewalls protect computers by controlling network traffic based on rules about IPs, ports, and protocols.

UFW offers a simple way to manage firewall rules, while iptables provides detailed, powerful control.

Understanding how iptables processes rules in order is critical to creating effective firewall policies.

Firewalls are essential but not sufficient alone; they must be part of a broader security strategy.

Knowing the connection between UFW and iptables helps troubleshoot and customize firewall behavior.

Practice

1. What is the primary purpose of a firewall like ufw or iptables on a Linux system?

easy

A. To update the Linux kernel automatically

B. To speed up the internet connection

C. To manage user accounts and passwords

D. To control network access and protect the system from unauthorized connections

Solution

1. Step 1: Understand firewall function

   A firewall controls network traffic to protect the system from unwanted access.

2. Step 2: Identify the correct purpose

   Options B, C, and D describe unrelated system tasks, so only To control network access and protect the system from unauthorized connections fits.

3. Final Answer:

   To control network access and protect the system from unauthorized connections -> Option D

4. Quick Check:

   Firewall = network protection [OK]

Hint: Firewalls block or allow network traffic to protect your system [OK]

Common Mistakes:

• Confusing firewall with system update tools
• Thinking firewall manages user accounts
• Assuming firewall speeds up internet

2. Which of the following is the correct command to enable the ufw firewall?

easy

A. ufw enable

B. ufw start

C. ufw on

D. ufw activate

Solution

1. Step 1: Recall ufw command to enable firewall

   The correct command to enable ufw is ufw enable.

2. Step 2: Check other options

   Commands like ufw start, ufw on, and ufw activate are invalid.

3. Final Answer:

   ufw enable -> Option A

4. Quick Check:

   Enable ufw = ufw enable [OK]

Hint: Remember: 'enable' starts ufw, not 'start' or 'on' [OK]

Common Mistakes:

• Using 'ufw start' instead of 'ufw enable'
• Typing 'ufw on' which is not a valid command
• Confusing with systemctl commands

3. What will be the output of the command sudo ufw status after running sudo ufw allow 22 and sudo ufw enable on a fresh system?

medium

A. Status: active\nTo Action From\n-- ------ ----\n80 ALLOW Anywhere

B. Status: active\nTo Action From\n-- ------ ----\n22 ALLOW Anywhere

C. Status: active\nNo rules configured

D. Status: inactive\nNo rules configured

Solution

1. Step 1: Understand commands run

   sudo ufw allow 22 opens port 22 (SSH). sudo ufw enable activates the firewall.

2. Step 2: Predict ufw status output

   The status will be active and show port 22 allowed from anywhere.

3. Final Answer:

   Status: active\nTo Action From\n-- ------ ----\n22 ALLOW Anywhere -> Option B

4. Quick Check:

   Allow 22 + enable = active with port 22 allowed [OK]

Hint: Allow port then enable ufw to see active status with rules [OK]

Common Mistakes:

• Expecting status inactive after enabling
• Confusing allowed ports (80 vs 22)
• Missing the 'active' status line

4. You wrote the command sudo ufw allow sshd but it returns an error. What is the likely cause and how to fix it?

medium

A. The service name 'sshd' is incorrect; use 'ssh' instead

B. You need to run the command without sudo

C. The firewall is disabled; enable it first

D. The port number must be specified instead of service name

Solution

1. Step 1: Identify the error cause

   The service name for SSH in ufw is 'ssh', not 'sshd'. Using 'sshd' causes an error.

2. Step 2: Correct the command

   Use sudo ufw allow ssh to allow SSH traffic properly.

3. Final Answer:

   The service name 'sshd' is incorrect; use 'ssh' instead -> Option A

4. Quick Check:

   Use correct service names like 'ssh' [OK]

Hint: Use 'ssh' not 'sshd' as ufw service name [OK]

Common Mistakes:

• Trying without sudo and expecting success
• Assuming firewall must be enabled before allowing ports
• Using port numbers when service names are accepted

5. You want to block all incoming traffic except SSH (port 22) and HTTP (port 80) using iptables. Which sequence of commands achieves this correctly?

hard

A. sudo iptables -P OUTPUT DROP\nsudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT\nsudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

B. sudo iptables -P INPUT ACCEPT\nsudo iptables -A INPUT -p tcp --dport 22 -j DROP\nsudo iptables -A INPUT -p tcp --dport 80 -j DROP

C. sudo iptables -P INPUT DROP\nsudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT\nsudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT\nsudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

D. sudo iptables -P INPUT DROP\nsudo iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT\nsudo iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT

Solution

1. Step 1: Set default policy to DROP incoming traffic

   sudo iptables -P INPUT DROP blocks all incoming by default.

2. Step 2: Allow incoming SSH and HTTP ports

   Commands to accept TCP traffic on ports 22 and 80 allow SSH and HTTP.

3. Step 3: Allow established connections

   sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT lets responses through.

4. Final Answer:

   sudo iptables -P INPUT DROP\nsudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT\nsudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT\nsudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -> Option C

5. Quick Check:

   Default DROP + allow ports 22,80 + established accept = correct [OK]

Hint: Set default DROP, then allow needed ports and established states [OK]

Common Mistakes:

• Setting OUTPUT policy instead of INPUT
• Dropping allowed ports instead of accepting
• Forgetting to allow established connections