Skip to main content
Back to Category

Firewall Configuration: iptables and ufw Guide

Configure a Linux server firewall using iptables and ufw: create SSH/HTTP/HTTPS rules, persist rules across reboots, and test your firewall setup effectively.

Read time: 12 min Server Management
firewalliptablesufwsecurityportlinuxserver
Author
REXE Teknoloji Network & Security Team
Editor
REXE Teknoloji Technical Editorial
First published
Last updated

Firewall Configuration: iptables and ufw Guide

A firewall controls incoming and outgoing network traffic on your server. Linux offers two popular tools: the powerful low-level iptables and the user-friendly ufw (Uncomplicated Firewall). This guide covers both.

REXE servers include a network-level Path Panel firewall. A server-side firewall adds an extra security layer. Using both together is recommended.

iptables Basics

iptables is the command-line tool that manages Linux kernel's netfilter framework. It handles packet filtering, NAT, and port forwarding.

Viewing Current Rules

hljs bash
# List all rules
sudo iptables -L -n -v

# List with line numbers
sudo iptables -L -n -v --line-numbers

# View NAT table
sudo iptables -t nat -L -n -v

Core iptables Concepts

ConceptDescription
ChainRule chain: INPUT, OUTPUT, FORWARD
TableRule table: filter, nat, mangle
TargetRule action: ACCEPT, DROP, REJECT
MatchMatch criteria: port, protocol, IP

Creating Basic Rules

hljs bash
# Allow loopback interface
sudo iptables -A INPUT -i lo -j ACCEPT

# Allow established connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH (port 22)
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow HTTP (port 80)
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# Allow HTTPS (port 443)
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Drop all other incoming traffic
sudo iptables -A INPUT -j DROP

Always allow SSH before adding a DROP rule. Otherwise you will lock yourself out of the server.

Deleting Rules

hljs bash
# Delete by rule number
sudo iptables -D INPUT 3

# Delete by rule content
sudo iptables -D INPUT -p tcp --dport 80 -j ACCEPT

# Flush all rules
sudo iptables -F

Allowing / Blocking Specific IPs

hljs bash
# Allow specific IP for SSH
sudo iptables -A INPUT -s 192.168.1.100 -p tcp --dport 22 -j ACCEPT

# Block a specific IP
sudo iptables -A INPUT -s 10.0.0.5 -j DROP

# Block an IP range
sudo iptables -A INPUT -s 192.168.1.0/24 -j DROP

Persisting iptables Rules

iptables rules are lost on reboot by default. To make them persistent:

Debian/Ubuntu

hljs bash
# Install iptables-persistent
sudo apt install iptables-persistent -y

# Save current rules
sudo netfilter-persistent save

# Reload rules
sudo netfilter-persistent reload

RHEL/CentOS/AlmaLinux

hljs bash
# Install iptables-services
sudo yum install iptables-services -y

# Enable and start the service
sudo systemctl enable iptables
sudo systemctl start iptables

# Save rules
sudo service iptables save

Managing Firewall with ufw

ufw abstracts iptables complexity into simple commands. It comes pre-installed on Ubuntu and Debian.

Installing and Enabling ufw

hljs bash
# Install ufw
sudo apt install ufw -y

# Check status
sudo ufw status verbose

# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

Always allow SSH before enabling ufw to avoid locking yourself out!

Basic ufw Rules

hljs bash
# Allow SSH
sudo ufw allow ssh
# or by port:
sudo ufw allow 22/tcp

# Allow HTTP and HTTPS
sudo ufw allow http
sudo ufw allow https
# or:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Open a custom port
sudo ufw allow 8080/tcp

# Enable ufw
sudo ufw enable

Managing ufw Rules

hljs bash
# List rules with numbers
sudo ufw status numbered

# Delete rule by number
sudo ufw delete 3

# Delete rule by content
sudo ufw delete allow 8080/tcp

# Allow from specific IP
sudo ufw allow from 192.168.1.100

# Block specific IP
sudo ufw deny from 10.0.0.5

# Disable ufw
sudo ufw disable

# Reset all rules
sudo ufw reset

Application Profiles

ufw includes ready-made profiles for common applications:

hljs bash
# List available profiles
sudo ufw app list

# Enable Nginx profile
sudo ufw allow 'Nginx Full'

# Enable OpenSSH profile
sudo ufw allow 'OpenSSH'

Testing Your Firewall

Port Scanning with nmap

hljs bash
# Scan specific ports from another machine
nmap -sT -p 22,80,443 SERVER_IP

# Scan all ports
nmap -sT SERVER_IP

Check Listening Ports with ss

hljs bash
# List listening TCP ports
sudo ss -tlnp

# List all connections
sudo ss -tunap

Connection Testing

hljs bash
# Test specific port
telnet SERVER_IP 80

# Test with nc
nc -zv SERVER_IP 443

# HTTP test with curl
curl -I http://SERVER_IP

Security Recommendations

Apply the principle of least privilege: only open ports that are actually needed.

  1. Change the SSH port: Use a non-standard port instead of 22
  2. Apply rate limiting: Protect against brute-force attacks
  3. Install Fail2Ban: Automatically block failed login attempts
  4. Audit regularly: Review rules with iptables -L or ufw status
  5. Back up rules: Save rules to a file
hljs bash
# Save iptables rules to file
sudo iptables-save > /etc/iptables/rules.v4

# Restore from file
sudo iptables-restore < /etc/iptables/rules.v4

Conclusion

iptables offers power and flexibility while ufw provides speed and simplicity. Beginners should start with ufw; advanced configurations benefit from iptables. Both tools work alongside REXE's Path Panel firewall. Review your firewall rules regularly and close any ports that are no longer needed.

Frequently Asked Questions

Are firewall rules lost when the server reboots?

Yes, iptables rules are temporary by default. To persist them on Debian/Ubuntu, install iptables-persistent with 'sudo apt install iptables-persistent' and save with 'sudo netfilter-persistent save'. ufw rules are automatically persistent.

Should I use ufw or iptables?

ufw is better for beginners and standard use cases — commands are simpler and the risk of mistakes is lower. Use iptables for complex scenarios like custom NAT, port forwarding, or advanced packet filtering.

What is the difference between Path Panel firewall and server-side firewall?

Path Panel operates at the network level (upstream) and filters traffic before it reaches your server — ideal for DDoS protection and large-scale blocking. Server-side firewall (iptables/ufw) operates at the OS level and provides fine-grained rule management. Using both together gives the best security.

I accidentally locked myself out of the server. What should I do?

Access your server via VNC/KVM console from the REXE customer panel. From the console, run 'sudo iptables -F' or 'sudo ufw disable' to clear the rules.

Related Articles

Network TrafficInbound— GbpsOutbound— Gbps