Firewall basics (ufw, iptables) in Linux CLI - Step-by-Step Execution

Concept Flow - Firewall basics (ufw, iptables)

Start: No rules

↓

Add rule with ufw or iptables

↓

Rule stored in firewall config

↓

Firewall active: packets checked

↓

Packet matches rule?

No→Block or default action

Yes↓

Allow or reject packet

↓

End: Packet processed

The firewall starts with no rules, then rules are added using ufw or iptables. When active, each network packet is checked against these rules to decide if it is allowed or blocked.

Execution Sample

Linux CLI

sudo ufw allow 22
sudo ufw enable
sudo ufw status
sudo iptables -L

This sequence adds a rule to allow SSH (port 22), enables ufw, shows ufw status, then lists iptables rules.

Execution Table

Step	Command	Action	Result/Output
1	sudo ufw allow 22	Add rule to allow incoming TCP on port 22	Rule added: '22/tcp' ALLOW IN
2	sudo ufw enable sudo ufw status	Activate firewall and show current ufw rules	Status: active 22/tcp ALLOW IN Anywhere
3	sudo iptables -L	List iptables rules	Chain INPUT (policy DROP) ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
4	Packet arrives on port 22	Check rules	Packet allowed (matches rule)
5	Packet arrives on port 80	Check rules	Packet blocked (no matching allow rule)

💡 Firewall processes packets until all rules checked; unmatched packets follow default policy (block or allow).

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
ufw_rules	empty	allow 22/tcp added	show 22/tcp allow	unchanged	22/tcp allow
iptables_rules	default DROP	unchanged	INPUT chain has ACCEPT tcp dpt:ssh	unchanged	INPUT chain ACCEPT tcp dpt:ssh
packet_port_22	N/A	N/A	N/A	N/A	allowed
packet_port_80	N/A	N/A	N/A	N/A	blocked

Key Moments - 3 Insights

Why does 'sudo ufw allow 22' let SSH through but not HTTP on port 80?

Because the rule explicitly allows port 22 only. The execution_table row 5 shows packets on port 80 are blocked since no rule allows them.

What is the difference between ufw and iptables commands here?

ufw is a simpler interface to manage firewall rules, while iptables shows the detailed rules. Execution_table rows 2 and 3 show ufw status and iptables listing respectively.

What happens if a packet does not match any rule?

It follows the default policy, which is usually to block. Execution_table row 5 shows a packet on port 80 blocked due to no matching rule.

Visual Quiz - 3 Questions

Look at the execution_table, what is the output of 'sudo ufw status' at step 2?

A Status: active 22/tcp ALLOW IN Anywhere

B Status: inactive

C No rules configured

D Error: command not found

💡 Hint

Check execution_table row 2 under Result/Output.

At which step does the firewall allow packets on port 22?

A Step 1

B Step 4

C Step 5

D Step 3

💡 Hint

Look at execution_table row 4 where packet on port 22 is processed.

If you add a rule to allow port 80, how would the packet on port 80 be handled?

A Firewall would crash

B It would still be blocked

C It would be allowed

D Packet would be rejected with error

💡 Hint

Refer to variable_tracker row for packet_port_80 and how rules affect packet handling.

Concept Snapshot

Firewall basics:
- Use 'ufw allow <port>' to add simple rules
- Use 'ufw status' to see rules
- 'iptables -L' shows detailed rules
- Packets checked against rules in order
- Default policy blocks unmatched packets
- ufw is easier; iptables is detailed

Full Transcript

This visual execution shows how firewall rules are added and processed using ufw and iptables. First, a rule is added to allow SSH on port 22 using 'sudo ufw allow 22'. Then, 'sudo ufw status' confirms the rule is active. 'sudo iptables -L' lists the detailed rules, showing the ACCEPT rule for SSH. When a packet arrives on port 22, it matches the allow rule and is accepted. A packet on port 80 does not match any rule and is blocked by default. Variables track the rules and packet states step-by-step. Key moments clarify why only port 22 is allowed and the difference between ufw and iptables. The quiz tests understanding of rule effects and outputs. This helps beginners see how firewall rules control network traffic simply and clearly.

Practice

1. What is the primary purpose of a firewall like ufw or iptables on a Linux system?

easy

A. To update the Linux kernel automatically

B. To speed up the internet connection

C. To manage user accounts and passwords

D. To control network access and protect the system from unauthorized connections

Solution

1. Step 1: Understand firewall function

   A firewall controls network traffic to protect the system from unwanted access.

2. Step 2: Identify the correct purpose

   Options B, C, and D describe unrelated system tasks, so only To control network access and protect the system from unauthorized connections fits.

3. Final Answer:

   To control network access and protect the system from unauthorized connections -> Option D

4. Quick Check:

   Firewall = network protection [OK]

Hint: Firewalls block or allow network traffic to protect your system [OK]

Common Mistakes:

• Confusing firewall with system update tools
• Thinking firewall manages user accounts
• Assuming firewall speeds up internet

2. Which of the following is the correct command to enable the ufw firewall?

easy

A. ufw enable

B. ufw start

C. ufw on

D. ufw activate

Solution

1. Step 1: Recall ufw command to enable firewall

   The correct command to enable ufw is ufw enable.

2. Step 2: Check other options

   Commands like ufw start, ufw on, and ufw activate are invalid.

3. Final Answer:

   ufw enable -> Option A

4. Quick Check:

   Enable ufw = ufw enable [OK]

Hint: Remember: 'enable' starts ufw, not 'start' or 'on' [OK]

Common Mistakes:

• Using 'ufw start' instead of 'ufw enable'
• Typing 'ufw on' which is not a valid command
• Confusing with systemctl commands

3. What will be the output of the command sudo ufw status after running sudo ufw allow 22 and sudo ufw enable on a fresh system?

medium

A. Status: active\nTo Action From\n-- ------ ----\n80 ALLOW Anywhere

B. Status: active\nTo Action From\n-- ------ ----\n22 ALLOW Anywhere

C. Status: active\nNo rules configured

D. Status: inactive\nNo rules configured

Solution

1. Step 1: Understand commands run

   sudo ufw allow 22 opens port 22 (SSH). sudo ufw enable activates the firewall.

2. Step 2: Predict ufw status output

   The status will be active and show port 22 allowed from anywhere.

3. Final Answer:

   Status: active\nTo Action From\n-- ------ ----\n22 ALLOW Anywhere -> Option B

4. Quick Check:

   Allow 22 + enable = active with port 22 allowed [OK]

Hint: Allow port then enable ufw to see active status with rules [OK]

Common Mistakes:

• Expecting status inactive after enabling
• Confusing allowed ports (80 vs 22)
• Missing the 'active' status line

4. You wrote the command sudo ufw allow sshd but it returns an error. What is the likely cause and how to fix it?

medium

A. The service name 'sshd' is incorrect; use 'ssh' instead

B. You need to run the command without sudo

C. The firewall is disabled; enable it first

D. The port number must be specified instead of service name

Solution

1. Step 1: Identify the error cause

   The service name for SSH in ufw is 'ssh', not 'sshd'. Using 'sshd' causes an error.

2. Step 2: Correct the command

   Use sudo ufw allow ssh to allow SSH traffic properly.

3. Final Answer:

   The service name 'sshd' is incorrect; use 'ssh' instead -> Option A

4. Quick Check:

   Use correct service names like 'ssh' [OK]

Hint: Use 'ssh' not 'sshd' as ufw service name [OK]

Common Mistakes:

• Trying without sudo and expecting success
• Assuming firewall must be enabled before allowing ports
• Using port numbers when service names are accepted

5. You want to block all incoming traffic except SSH (port 22) and HTTP (port 80) using iptables. Which sequence of commands achieves this correctly?

hard

A. sudo iptables -P OUTPUT DROP\nsudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT\nsudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

B. sudo iptables -P INPUT ACCEPT\nsudo iptables -A INPUT -p tcp --dport 22 -j DROP\nsudo iptables -A INPUT -p tcp --dport 80 -j DROP

C. sudo iptables -P INPUT DROP\nsudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT\nsudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT\nsudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

D. sudo iptables -P INPUT DROP\nsudo iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT\nsudo iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT

Solution

1. Step 1: Set default policy to DROP incoming traffic

   sudo iptables -P INPUT DROP blocks all incoming by default.

2. Step 2: Allow incoming SSH and HTTP ports

   Commands to accept TCP traffic on ports 22 and 80 allow SSH and HTTP.

3. Step 3: Allow established connections

   sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT lets responses through.

4. Final Answer:

   sudo iptables -P INPUT DROP\nsudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT\nsudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT\nsudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -> Option C

5. Quick Check:

   Default DROP + allow ports 22,80 + established accept = correct [OK]

Hint: Set default DROP, then allow needed ports and established states [OK]

Common Mistakes:

• Setting OUTPUT policy instead of INPUT
• Dropping allowed ports instead of accepting
• Forgetting to allow established connections