[Linux Security] Understanding Firewalls and How to Configure UFW & iptables

by

When operating a Linux server connected to the internet, network security is your top priority. Thousands of automated bots and malicious scripts continuously scan public IP addresses looking for open ports, vulnerable services, and unpatched security loopholes.

The first and most critical line of defense for any Linux server is a Firewall. A firewall acts as a digital gatekeeper, controlling inbound and outbound network traffic based on predefined security rules.

Today, we will cover the fundamental concepts of firewalls and provide a step-by-step guide on how to configure the two most popular Linux firewall management tools: UFW and iptables.

1. What is a Server Firewall?

A firewall is a network security system that monitors and filters incoming and outgoing network traffic. It determines whether to allow, block (drop), or reject specific packets based on security rules set by the system administrator.

How a Firewall Filters Traffic

  1. Inbound Traffic: Requests coming from external computers or internet clients trying to access services running on your server (e.g., HTTP requests on Port 80 or SSH connections on Port 22).
  2. Outbound Traffic: Requests initiated by your server connecting to external servers or web services (e.g., downloading system package updates).

Without a configured firewall, every service running on your server with an open listening port is exposed directly to the public internet.

2. UFW vs. iptables: What’s the Difference?

When managing firewalls on Linux (specifically Ubuntu/Debian distributions), you will frequently encounter two names: iptables and UFW.

  • iptables (The Low-Level Engine): A traditional, extremely powerful command-line utility that interacts directly with the Linux kernel’s netfilter packet-filtering framework. While powerful, its syntax can be complex and steep for beginners.
  • UFW (Uncomplicated Firewall): A user-friendly front-end interface built on top of iptables. Designed primarily for Ubuntu, UFW simplifies rule management into readable, intuitive commands.

3. How to Configure UFW (Uncomplicated Firewall)

UFW is the default firewall tool on Ubuntu. It is recommended for beginners and most standard web server deployments.

Step 1: Check UFW Status

By default, UFW is often installed but disabled.

Bash

sudo ufw status verbose

Step 2: Set Default Security Policies

A secure firewall posture follows a “Deny All Inbound, Allow All Outbound” policy.

Bash

sudo ufw default deny incoming
sudo ufw default allow outgoing

Step 3: Allow Necessary Service Ports

Before enabling UFW, explicitly permit essential ports so you don’t lock yourself out of your server.

Bash

# Allow SSH access (Default Port 22)
sudo ufw allow 22/tcp

# If using a custom SSH port (e.g., Port 2222)
sudo ufw allow 2222/tcp

# Allow Web Traffic (HTTP & HTTPS)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Step 4: Enable UFW

Once your SSH port is allowed, activate the firewall:

Bash

sudo ufw enable

Confirm by typing y when prompted.

Step 5: Advanced UFW Rules

  • Block a specific IP address:Bashsudo ufw deny from 203.0.113.50
  • Allow access from a specific IP to a specific port:Bashsudo ufw allow from 198.51.100.25 to any port 3306 proto tcp # Allow MySQL access for a specific IP
  • Delete a rule:Bashsudo ufw delete allow 80/tcp

4. How to Configure iptables (Low-Level Control)

iptables organizes packet-filtering rules into Chains (INPUT, OUTPUT, FORWARD) and Tables (filter, nat, mangle).

Core iptables Chains

  • INPUT: Controls incoming connections aimed at the server.
  • OUTPUT: Controls outgoing traffic originating from the server.
  • FORWARD: Controls traffic passing through the server (used when the server acts as a router).

Step 1: View Current Rules

Bash

sudo iptables -L -v -n
  • -L: List rules.
  • -v: Verbose output (show packet counts and interfaces).
  • -n: Display IP addresses and port numbers numerically.

Step 2: Set Default Policies

Bash

sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

Step 3: Allow Loopback and Established Connections

Always permit internal loopback traffic (lo) and existing connections:

Bash

# Allow local loopback interface
sudo iptables -A INPUT -i lo -j ACCEPT

# Allow established and related connections
sudo iptables -A INPUT -m conntrack --state ESTABLISHED,RELATED -j ACCEPT

Step 4: Open Essential Ports

Append (-A) rules to the INPUT chain:

Bash

# Allow SSH (Port 22)
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow HTTP (Port 80) and HTTPS (Port 443)
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Step 5: Save iptables Rules

iptables rules are stored in volatile memory and will disappear upon reboot unless saved.

On Ubuntu/Debian, install iptables-persistent:

Bash

sudo apt install iptables-persistent -y
sudo netfilter-persistent save

5. UFW vs. iptables Quick Comparison

FeatureUFW (Uncomplicated Firewall)iptables
ComplexityVery Easy / Intuitive syntaxModerate to High / Complex syntax
Underlying EngineUses iptables / nftables underneathInteracts directly with Linux Kernel (netfilter)
PersistencePersistent across reboots by defaultRequires iptables-persistent to save rules
Best ForStandard web servers, VPS, beginnersAdvanced networking, NAT routers, custom chains

6. Summary Checklist for Firewall Configuration

  1. Always open SSH ports first before enabling your firewall to avoid losing remote access.
  2. Adopt a Default Deny Incoming policy to block unapproved ports automatically.
  3. Open only the ports required by active services (e.g., 80/443 for web servers, 3306 for databases).
  4. Restrict database ports (MySQL, PostgreSQL) to trusted backend IP addresses rather than leaving them open to the public.

Setting up a properly configured firewall with UFW or iptables is an essential security milestone that keeps your Linux server safe, reliable, and resilient against unauthorized intrusions!

Leave a Comment