Firewalls

Here is the truth about firewalls: they are not a magic shield – they are deliberate rules about who may speak to whom. A misconfigured firewall is either a locked door with the window open, or a doorstop.

What it is, in plain words

A firewall filters network traffic according to rules. It can run:

on a host (iptables/nftables, Windows Firewall, pf on BSD);
on a network edge (router, cloud security group, dedicated appliance);
or as a service mesh / reverse proxy layer that understands HTTP.

Rules match on addresses, ports, protocols, interfaces and sometimes application data (next-generation / layer-7 firewalls). Default posture should be deny inbound, allow established outbound, then open only what you need.

Related pages on this site dig into flavours: packet filtering, stateful, stateless, circuit-level, application proxy, NG firewall.

Why it matters

Every open port is a promise: “I am running something here and I will keep it patched.” Firewalls make those promises conscious. Combined with SSH hardening and minimal services, they turn a noisy internet into background radiation your box ignores.

An everyday analogy: a nightclub door

The bouncer (firewall) checks ID and guest list (rules). Regulars already inside can go to the bar and back (established connections). Random people off the street don’t get in just because they knock on every door (port scan). A VIP pass for the kitchen (port 22 for your IP only) is safer than opening the kitchen to the street.

flowchart LR
  I[Internet] --> F{Firewall}
  F -- allow 80/443 --> W[Web]
  F -- allow 22 from admin IP --> S[sshd]
  F -- deny --> X[dropped]

A hands-on example: nftables on a small server

sudo nft flush ruleset
sudo nft -f - <<'EOF'
table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    ct state established,related accept
    iif lo accept
    ip protocol icmp accept
    ip6 nexthdr icmpv6 accept
    tcp dport { 80, 443 } accept
    tcp dport 22 ip saddr 203.0.113.10 accept
  }
  chain forward {
    type filter hook forward priority 0; policy drop;
  }
  chain output {
    type filter hook output priority 0; policy accept;
  }
}
EOF
sudo nft list ruleset

On Ubuntu, UFW is a friendlier front end:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow from 203.0.113.10 to any port 22
sudo ufw enable

Cloud providers add another layer (security groups / cloud firewalls). Use both: cloud rules as the outer fence, host rules as the inner.

Logging and rate limiting

A silent firewall makes debugging hard. Log new drops sparingly (not every scan packet) or you’ll fill the disk:

sudo nft add rule inet filter input tcp dport 22 ct state new limit rate 10/minute accept
sudo nft add rule inet filter input log prefix "drop: " flags all counter drop

Watch with journalctl -k -f or your nft/ulogd pipeline. Rate limits on SSH and connection tracking of weird traffic buy time against brute force without locking you out of your own box – keep a console or out-of-band path ready.

Common misconceptions

“Firewall = antivirus.” Different jobs. One filters packets; the other hunts malware.
“Once it’s set, forget it.” Rules rot. Review when you add services.
“Blocking ping increases security.” Mostly obscurity; breaks diagnostics. Rate-limit if needed.
“Stateful means deep packet inspection.” Stateful means tracking connections. DPI is a different (heavier) feature.
“I have a firewall, so I’m safe.” It won’t fix weak passwords, 0-days in exposed apps, or an attacker who phished your admin.

Connections

Packet filtering, Stateful, Stateless.
Linux Security, Computer Security, Networking.
Online VPS, SSH Login.
What is a firewall?
Implement your own firewall in C

Types of Firewalls

PacketFilteringFireWall
StatelessFirewall
StatefullFirewall
Circuit-Level-Firewall
Application-Proxy

UFW

The Uncomplicated Firewall (ufw) is a frontend for iptables and is particularly well-suited for host-based firewalls.

Ubuntu Article Dreamhost Article on UFW Firewall