TopolearnA default-deny firewall that allows only the services you run is basic server hygiene.
The kernel's packet filter is netfilter, configured today with nftables (nft), the successor to iptables. On most iptables-using systems the iptables command is a compatibility layer over nftables. Distributions add friendlier front ends:
- ufw on Ubuntu:
ufw allow 443/tcp,ufw allow from 10.0.0.0/8 to any port 5432,ufw enable,ufw status numbered, - firewalld on Fedora/RHEL: zones with services,
firewall-cmd --add-service=https --permanentfollowed by--reload.
Use one front end per machine; mixing them produces confusing, overlapping rules.
The typical policy for a server's input chain: drop by default, accept packets of established/related connections (replies to traffic you started), accept the loopback interface, accept the specific ports you serve, and accept ICMP. With IPv6, ICMPv6 is essential: neighbour discovery breaks without it.
Before enabling a default-drop policy over SSH, allow SSH first, and keep a second session open or use a timed rollback; locking yourself out of a remote machine is a rite of passage best avoided.
Remember that cloud environments add security groups in front of the host, and Docker inserts its own rules for published ports, which can bypass ufw. Check what really happens with nft list ruleset.
Example
# Ubuntu: ufw
sudo ufw allow OpenSSH # FIRST, or you lock yourself out
sudo ufw allow 443/tcp
sudo ufw allow from 10.0.0.0/8 to any port 5432 proto tcp
sudo ufw enable && sudo ufw status verbose
# Fedora / RHEL: firewalld
sudo firewall-cmd --add-service=https --permanent && sudo firewall-cmd --reload
# nftables directly, /etc/nftables.conf:
# table inet filter {
# chain input {
# type filter hook input priority 0; policy drop;
# ct state established,related accept
# iif lo accept
# meta l4proto { icmp, ipv6-icmp } accept
# tcp dport { 22, 443 } accept
# }
# }
sudo nft -c -f /etc/nftables.conf && sudo nft -f /etc/nftables.conf # check, then load
sudo nft list ruleset # what is really activeRemember
- nftables is the kernel firewall; ufw and firewalld are front ends
- Default drop, allow established, loopback, ICMP and your ports
- Allow SSH before enabling a firewall remotely
Watch out for
- Enabling a default-deny firewall over SSH without allowing port 22 first.