Overview

• What you’ll learn: Firewall concepts, the Linux netfilter framework, how iptables chains and rules work, using ufw as a simplified front-end, common firewall policies for servers, logging, and rate limiting.
• Prerequisites: Lesson 18 – DHCP Server with isc-kea
• Estimated reading time: 22 minutes

Introduction

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined rules. On Linux servers, the firewall is your first line of defense against unauthorized access, port scanning, and network-based attacks.

Linux implements firewalling through the netfilter framework in the kernel. The traditional user-space tool for configuring netfilter is iptables, which provides fine-grained control over packet filtering, NAT, and traffic mangling. Ubuntu provides ufw (Uncomplicated Firewall) as a simplified front-end that makes common firewall tasks accessible without memorizing complex iptables syntax.

In this lesson, you will learn both tools: ufw for everyday firewall management and iptables for advanced scenarios requiring granular control.

UFW — Uncomplicated Firewall

UFW is the default firewall management tool on Ubuntu. It provides a simple command-line interface for managing firewall rules. Behind the scenes, ufw translates your commands into iptables rules.

# Check ufw status
$ sudo ufw status verbose
Status: inactive

# Enable the firewall (CAUTION: ensure SSH is allowed first!)
$ sudo ufw allow ssh
Rules updated

$ sudo ufw enable
Firewall is active and enabled on system startup

# Check status with numbered rules
$ sudo ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 1] 22/tcp (v6)                ALLOW IN    Anywhere (v6)

# Allow common services
$ sudo ufw allow http          # Port 80
$ sudo ufw allow https         # Port 443
$ sudo ufw allow 53            # DNS (TCP and UDP)
$ sudo ufw allow 53/tcp        # DNS TCP only
$ sudo ufw allow 53/udp        # DNS UDP only

# Allow from a specific IP or subnet
$ sudo ufw allow from 192.168.1.0/24 to any port 22
$ sudo ufw allow from 10.0.0.5 to any port 3306

# Deny a specific port
$ sudo ufw deny 23             # Block telnet

# Delete a rule by number
$ sudo ufw delete 3

# Set default policies
$ sudo ufw default deny incoming
$ sudo ufw default allow outgoing

# View the full ufw status
$ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)

     To                         Action      From
     --                         ------      ----
22/tcp                         ALLOW IN    Anywhere
80/tcp                         ALLOW IN    Anywhere
443/tcp                        ALLOW IN    Anywhere

IPtables Fundamentals

For advanced firewall configurations, you need to understand iptables directly. Iptables organizes rules into tables and chains. The three most important tables are: filter (default — for packet filtering), nat (for address translation), and mangle (for packet modification).

The filter table has three built-in chains: INPUT (packets destined for the local machine), OUTPUT (packets originating from the local machine), and FORWARD (packets being routed through the machine).

# View current iptables rules
$ sudo iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source        destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source        destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source        destination

# Allow established and related connections
$ sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow loopback traffic
$ sudo iptables -A INPUT -i lo -j ACCEPT

# Allow SSH from anywhere
$ sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow HTTP and HTTPS
$ sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow ICMP (ping)
$ sudo iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Drop everything else (set default policy)
$ sudo iptables -P INPUT DROP
$ sudo iptables -P FORWARD DROP
$ sudo iptables -P OUTPUT ACCEPT

Advanced iptables Rules

Iptables supports powerful matching criteria including source/destination addresses, port ranges, connection states, rate limiting, and logging.

# Rate limit SSH connections (prevent brute force)
$ sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW 
    -m recent --set --name SSH
$ sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW 
    -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP

# Allow a specific subnet to access MySQL
$ sudo iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 3306 -j ACCEPT

# Log dropped packets (useful for debugging)
$ sudo iptables -A INPUT -j LOG --log-prefix "IPT-DROP: " --log-level 4
$ sudo iptables -A INPUT -j DROP

# View logged packets
$ sudo journalctl -k | grep "IPT-DROP"

# NAT — Masquerade outgoing traffic (for router setups)
$ sudo iptables -t nat -A POSTROUTING -o ens34 -j MASQUERADE

# Port forwarding — Forward port 8080 to internal server
$ sudo iptables -t nat -A PREROUTING -i ens33 -p tcp --dport 8080 
    -j DNAT --to-destination 192.168.1.20:80
$ sudo iptables -A FORWARD -p tcp -d 192.168.1.20 --dport 80 -j ACCEPT

Persisting Firewall Rules

By default, iptables rules are lost on reboot. You need to save and restore them explicitly. The iptables-persistent package automates this process.

# Install iptables-persistent
$ sudo apt install -y iptables-persistent

# Save current rules
$ sudo netfilter-persistent save
run-parts: executing /usr/share/netfilter-persistent/plugins.d/15-ip4tables save
run-parts: executing /usr/share/netfilter-persistent/plugins.d/25-ip6tables save

# Rules are saved to:
# /etc/iptables/rules.v4 (IPv4)
# /etc/iptables/rules.v6 (IPv6)

# Manually save/restore
$ sudo iptables-save > /etc/iptables/rules.v4
$ sudo iptables-restore < /etc/iptables/rules.v4

# With ufw, rules are automatically persistent
# (ufw stores rules in /etc/ufw/ and loads them at boot)

Key Takeaways

• UFW is Ubuntu’s simplified firewall front-end; always allow SSH before enabling to avoid locking yourself out.
• The default policy should be “deny incoming, allow outgoing” — then explicitly allow only the services you need.
• Iptables provides granular control through tables (filter, nat, mangle) and chains (INPUT, OUTPUT, FORWARD) for advanced scenarios.
• Rate limiting with iptables protects against brute-force attacks; logging helps diagnose firewall issues.
• Use iptables-persistent to save rules across reboots, or rely on ufw which persists rules automatically.

What’s Next

In Lesson 20, you will learn Network Troubleshooting Tools — a comprehensive toolkit including ping, traceroute, mtr, ss, netstat, tcpdump, nmap, and Wireshark for diagnosing and resolving network issues.