Firewall Configuration: iptables and ufw Guide

A firewall controls incoming and outgoing network traffic on your server. Linux offers two popular tools: the powerful low-level iptables and the user-friendly ufw (Uncomplicated Firewall). This guide covers both.

REXE servers include a network-level Path Panel firewall. A server-side firewall adds an extra security layer. Using both together is recommended.

iptables Basics

iptables is the command-line tool that manages Linux kernel's netfilter framework. It handles packet filtering, NAT, and port forwarding.

Viewing Current Rules

hljs bash

# List all rules
sudo iptables -L -n -v

# List with line numbers
sudo iptables -L -n -v --line-numbers

# View NAT table
sudo iptables -t nat -L -n -v

Core iptables Concepts

Concept	Description
Chain	Rule chain: INPUT, OUTPUT, FORWARD
Table	Rule table: filter, nat, mangle
Target	Rule action: ACCEPT, DROP, REJECT
Match	Match criteria: port, protocol, IP

Creating Basic Rules

hljs bash

# Allow loopback interface
sudo iptables -A INPUT -i lo -j ACCEPT

# Allow established connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH (port 22)
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow HTTP (port 80)
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# Allow HTTPS (port 443)
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Drop all other incoming traffic
sudo iptables -A INPUT -j DROP

Always allow SSH before adding a DROP rule. Otherwise you will lock yourself out of the server.

Deleting Rules

hljs bash

# Delete by rule number
sudo iptables -D INPUT 3

# Delete by rule content
sudo iptables -D INPUT -p tcp --dport 80 -j ACCEPT

# Flush all rules
sudo iptables -F

Allowing / Blocking Specific IPs

hljs bash

# Allow specific IP for SSH
sudo iptables -A INPUT -s 192.168.1.100 -p tcp --dport 22 -j ACCEPT

# Block a specific IP
sudo iptables -A INPUT -s 10.0.0.5 -j DROP

# Block an IP range
sudo iptables -A INPUT -s 192.168.1.0/24 -j DROP

Persisting iptables Rules

iptables rules are lost on reboot by default. To make them persistent:

Debian/Ubuntu

hljs bash

# Install iptables-persistent
sudo apt install iptables-persistent -y

# Save current rules
sudo netfilter-persistent save

# Reload rules
sudo netfilter-persistent reload

RHEL/CentOS/AlmaLinux

hljs bash

# Install iptables-services
sudo yum install iptables-services -y

# Enable and start the service
sudo systemctl enable iptables
sudo systemctl start iptables

# Save rules
sudo service iptables save

Managing Firewall with ufw

ufw abstracts iptables complexity into simple commands. It comes pre-installed on Ubuntu and Debian.

Installing and Enabling ufw

hljs bash

# Install ufw
sudo apt install ufw -y

# Check status
sudo ufw status verbose

# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

Always allow SSH before enabling ufw to avoid locking yourself out!

Basic ufw Rules

hljs bash

# Allow SSH
sudo ufw allow ssh
# or by port:
sudo ufw allow 22/tcp

# Allow HTTP and HTTPS
sudo ufw allow http
sudo ufw allow https
# or:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Open a custom port
sudo ufw allow 8080/tcp

# Enable ufw
sudo ufw enable

Managing ufw Rules

hljs bash

# List rules with numbers
sudo ufw status numbered

# Delete rule by number
sudo ufw delete 3

# Delete rule by content
sudo ufw delete allow 8080/tcp

# Allow from specific IP
sudo ufw allow from 192.168.1.100

# Block specific IP
sudo ufw deny from 10.0.0.5

# Disable ufw
sudo ufw disable

# Reset all rules
sudo ufw reset

Application Profiles

ufw includes ready-made profiles for common applications:

hljs bash

# List available profiles
sudo ufw app list

# Enable Nginx profile
sudo ufw allow 'Nginx Full'

# Enable OpenSSH profile
sudo ufw allow 'OpenSSH'

Testing Your Firewall

Port Scanning with nmap

hljs bash

# Scan specific ports from another machine
nmap -sT -p 22,80,443 SERVER_IP

# Scan all ports
nmap -sT SERVER_IP

Check Listening Ports with ss

hljs bash

# List listening TCP ports
sudo ss -tlnp

# List all connections
sudo ss -tunap

Connection Testing

hljs bash

# Test specific port
telnet SERVER_IP 80

# Test with nc
nc -zv SERVER_IP 443

# HTTP test with curl
curl -I http://SERVER_IP

Security Recommendations

Apply the principle of least privilege: only open ports that are actually needed.

Change the SSH port: Use a non-standard port instead of 22
Apply rate limiting: Protect against brute-force attacks
Install Fail2Ban: Automatically block failed login attempts
Audit regularly: Review rules with iptables -L or ufw status
Back up rules: Save rules to a file

hljs bash

# Save iptables rules to file
sudo iptables-save > /etc/iptables/rules.v4

# Restore from file
sudo iptables-restore < /etc/iptables/rules.v4

Conclusion

iptables offers power and flexibility while ufw provides speed and simplicity. Beginners should start with ufw; advanced configurations benefit from iptables. Both tools work alongside REXE's Path Panel firewall. Review your firewall rules regularly and close any ports that are no longer needed.

Firewall Configuration: iptables and ufw Guide

Table of Contents