Network & Firewall Hardening

A server's network exposure is one of the most direct parts of its attack surface - and one of the most straightforward to actually reduce.

Default-deny

The soundest posture is default-deny: block everything, then explicitly allow only the specific ports a service genuinely needs. The alternative - leaving everything open and trying to remember to close the ones you don't need - reliably leaves something exposed that nobody remembers opening, usually discovered during an audit or, worse, an incident.

ufw vs. iptables

Both tools from earlier Linux lessons reappear here with security specifically in mind:

• iptables is the low-level Linux firewall - powerful, precise, and verbose to configure directly.
• ufw ("uncomplicated firewall") is a simpler frontend over the same underlying iptables rules, built for exactly the case of "allow SSH and HTTPS, deny everything else" without hand-writing raw rule syntax.

iptables -L

lists every chain and rule currently in effect - the ground truth of what traffic this host will actually accept, independent of whatever tool was used to configure it.

This applies in the cloud too

The cloud networking lesson's security groups are the exact same default-deny idea, just enforced by the cloud provider instead of the host's own kernel. The principle travels unchanged: list only what must be open, and treat every other port as closed until proven otherwise.

Try it

iptables -L

When you're ready, hit Mark complete and move to the next lesson.