Firewalls & Network Security

The Security Basics lesson mentioned firewalls in passing: "default deny, then open exactly what's needed." This lesson is that idea put into practice with the actual tool.

Default deny, one more time

A firewall's whole job is deciding which network traffic is allowed to reach a machine. The safe posture is always the same: block everything by default, then explicitly allow only what the box actually needs to serve. For a typical web server, that's usually just three ports: SSH (22) to manage it, and HTTP/HTTPS (80/443) to serve traffic - nothing else.

ufw: the friendly front-end

On Ubuntu and Debian-family systems, ufw ("Uncomplicated Firewall") is the tool you'll reach for day to day:

ufw status              # is it even on? what's currently allowed?
ufw enable               # turn the firewall on
ufw disable               # turn it off
ufw allow 22               # allow traffic on port 22 (SSH)
ufw allow 80                # allow traffic on port 80 (HTTP)
ufw deny 23                  # explicitly block port 23 (telnet - don't run this anyway)

ufw status after adding rules shows exactly what's permitted:

Status: active

To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
80                         ALLOW       Anywhere

Anything not listed here is denied by default the moment ufw is enabled - that's the entire point.

iptables: what ufw is a front-end for

Underneath ufw (and every other Linux firewall tool) is the kernel's own packet filter, configured through iptables (or its modern successor, nftables). iptables organizes rules into chains:

iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

• INPUT - traffic destined for this machine.
• FORWARD - traffic passing through this machine to somewhere else (relevant for routers).
• OUTPUT - traffic leaving this machine.

Each chain has a default policy (ACCEPT or DROP), and rules are checked top to bottom until one matches. ufw exists because hand-writing iptables rules correctly - and in the right order - is genuinely fiddly; ufw allow 22 quietly generates the equivalent iptables rule for you.

Beyond the firewall itself

A firewall controls reachability, not the whole security picture:

• fail2ban watches log files (like SSH's) for repeated failed login attempts and temporarily firewalls off the offending address - a firewall rule that writes itself in response to abuse.
• Cloud security groups (AWS, GCP, Azure) are the same default-deny idea, enforced one layer up, outside the machine entirely - useful because a misconfigured in-instance firewall can't accidentally lock out a security group's protection.

Try it

ufw status
ufw enable
ufw allow 22
ufw allow 80
ufw status
iptables -L

Further reading

• "UNIX and Linux System Administration Handbook" by Nemeth, Snyder, Hein, Whaley, and Mackin (Pearson) - covers firewall design as part of real production hardening, including the default-deny reasoning this lesson leads with.
• "How Linux Works" by Brian Ward (No Starch Press) - explains iptables' chain-and-policy model from the kernel's packet-filtering code outward.