Firewall basics (ufw, iptables) in Linux CLI - Mini Project: Build & Apply

Firewall basics (ufw, iptables)

📖 Scenario: You are managing a small Linux server that needs basic firewall protection. You want to allow only certain types of network traffic and block everything else to keep your server safe.

🎯 Goal: Learn how to set up simple firewall rules using ufw and iptables commands to allow SSH and HTTP traffic and block other connections.

📋 What You'll Learn

Create a basic firewall rule set using ufw

Create a basic firewall rule set using iptables

Allow SSH (port 22) and HTTP (port 80) traffic

Block all other incoming traffic

Display the active firewall rules

💡 Why This Matters

🌍 Real World

Setting up firewall rules is essential for protecting servers from unauthorized access and attacks. This project shows how to configure basic firewall rules using common Linux tools.

💼 Career

System administrators and DevOps engineers regularly configure firewalls to secure servers and networks. Knowing ufw and iptables basics is a key skill for these roles.

1

Set up initial ufw firewall rules

Create a variable called ufw_rules that contains the commands to allow SSH on port 22 and HTTP on port 80 using ufw. Also include the command to enable ufw with default deny incoming policy.

Linux CLI

# Your code here

Hint

Use a list to store the exact ufw commands as strings.

2

Set up initial iptables firewall rules

Create a variable called iptables_rules that contains the commands to set default policy to DROP for INPUT chain, allow incoming SSH on port 22, allow incoming HTTP on port 80, and allow established connections using iptables commands.

Linux CLI

ufw_rules = [
    'sudo ufw default deny incoming',
    'sudo ufw allow 22',
    'sudo ufw allow 80',
    'sudo ufw enable'
]
# Your code here

Hint

Use a list to store the exact iptables commands as strings.

3

Write a function to apply firewall rules

Write a function called apply_rules that takes a list of commands as input and prints each command prefixed with Executing:. Use a for loop with variable cmd to iterate over the list commands.

Linux CLI

ufw_rules = [
    'sudo ufw default deny incoming',
    'sudo ufw allow 22',
    'sudo ufw allow 80',
    'sudo ufw enable'
]

iptables_rules = [
    'sudo iptables -P INPUT DROP',
    'sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT',
    'sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT',
    'sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT'
]

def apply_rules(commands):
    # Your code here

Hint

Use a for loop to print each command with the prefix Executing:.

4

Display the firewall rules being applied

Call the function apply_rules twice: first with the variable ufw_rules, then with the variable iptables_rules. This will print all the commands to be executed.

Linux CLI

ufw_rules = [
    'sudo ufw default deny incoming',
    'sudo ufw allow 22',
    'sudo ufw allow 80',
    'sudo ufw enable'
]

iptables_rules = [
    'sudo iptables -P INPUT DROP',
    'sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT',
    'sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT',
    'sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT'
]

def apply_rules(commands):
    for cmd in commands:
        print(f"Executing: {cmd}")

apply_rules(ufw_rules)
# Your code here

Hint

Call apply_rules with both ufw_rules and iptables_rules to print all commands.

Practice

1. What is the primary purpose of a firewall like ufw or iptables on a Linux system?

easy

A. To update the Linux kernel automatically

B. To speed up the internet connection

C. To manage user accounts and passwords

D. To control network access and protect the system from unauthorized connections

Solution

1. Step 1: Understand firewall function

   A firewall controls network traffic to protect the system from unwanted access.

2. Step 2: Identify the correct purpose

   Options B, C, and D describe unrelated system tasks, so only To control network access and protect the system from unauthorized connections fits.

3. Final Answer:

   To control network access and protect the system from unauthorized connections -> Option D

4. Quick Check:

   Firewall = network protection [OK]

Hint: Firewalls block or allow network traffic to protect your system [OK]

Common Mistakes:

• Confusing firewall with system update tools
• Thinking firewall manages user accounts
• Assuming firewall speeds up internet

2. Which of the following is the correct command to enable the ufw firewall?

easy

A. ufw enable

B. ufw start

C. ufw on

D. ufw activate

Solution

1. Step 1: Recall ufw command to enable firewall

   The correct command to enable ufw is ufw enable.

2. Step 2: Check other options

   Commands like ufw start, ufw on, and ufw activate are invalid.

3. Final Answer:

   ufw enable -> Option A

4. Quick Check:

   Enable ufw = ufw enable [OK]

Hint: Remember: 'enable' starts ufw, not 'start' or 'on' [OK]

Common Mistakes:

• Using 'ufw start' instead of 'ufw enable'
• Typing 'ufw on' which is not a valid command
• Confusing with systemctl commands

3. What will be the output of the command sudo ufw status after running sudo ufw allow 22 and sudo ufw enable on a fresh system?

medium

A. Status: active\nTo Action From\n-- ------ ----\n80 ALLOW Anywhere

B. Status: active\nTo Action From\n-- ------ ----\n22 ALLOW Anywhere

C. Status: active\nNo rules configured

D. Status: inactive\nNo rules configured

Solution

1. Step 1: Understand commands run

   sudo ufw allow 22 opens port 22 (SSH). sudo ufw enable activates the firewall.

2. Step 2: Predict ufw status output

   The status will be active and show port 22 allowed from anywhere.

3. Final Answer:

   Status: active\nTo Action From\n-- ------ ----\n22 ALLOW Anywhere -> Option B

4. Quick Check:

   Allow 22 + enable = active with port 22 allowed [OK]

Hint: Allow port then enable ufw to see active status with rules [OK]

Common Mistakes:

• Expecting status inactive after enabling
• Confusing allowed ports (80 vs 22)
• Missing the 'active' status line

4. You wrote the command sudo ufw allow sshd but it returns an error. What is the likely cause and how to fix it?

medium

A. The service name 'sshd' is incorrect; use 'ssh' instead

B. You need to run the command without sudo

C. The firewall is disabled; enable it first

D. The port number must be specified instead of service name

Solution

1. Step 1: Identify the error cause

   The service name for SSH in ufw is 'ssh', not 'sshd'. Using 'sshd' causes an error.

2. Step 2: Correct the command

   Use sudo ufw allow ssh to allow SSH traffic properly.

3. Final Answer:

   The service name 'sshd' is incorrect; use 'ssh' instead -> Option A

4. Quick Check:

   Use correct service names like 'ssh' [OK]

Hint: Use 'ssh' not 'sshd' as ufw service name [OK]

Common Mistakes:

• Trying without sudo and expecting success
• Assuming firewall must be enabled before allowing ports
• Using port numbers when service names are accepted

5. You want to block all incoming traffic except SSH (port 22) and HTTP (port 80) using iptables. Which sequence of commands achieves this correctly?

hard

A. sudo iptables -P OUTPUT DROP\nsudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT\nsudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

B. sudo iptables -P INPUT ACCEPT\nsudo iptables -A INPUT -p tcp --dport 22 -j DROP\nsudo iptables -A INPUT -p tcp --dport 80 -j DROP

C. sudo iptables -P INPUT DROP\nsudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT\nsudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT\nsudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

D. sudo iptables -P INPUT DROP\nsudo iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT\nsudo iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT

Solution

1. Step 1: Set default policy to DROP incoming traffic

   sudo iptables -P INPUT DROP blocks all incoming by default.

2. Step 2: Allow incoming SSH and HTTP ports

   Commands to accept TCP traffic on ports 22 and 80 allow SSH and HTTP.

3. Step 3: Allow established connections

   sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT lets responses through.

4. Final Answer:

   sudo iptables -P INPUT DROP\nsudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT\nsudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT\nsudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -> Option C

5. Quick Check:

   Default DROP + allow ports 22,80 + established accept = correct [OK]

Hint: Set default DROP, then allow needed ports and established states [OK]

Common Mistakes:

• Setting OUTPUT policy instead of INPUT
• Dropping allowed ports instead of accepting
• Forgetting to allow established connections