Managing Firewall with ufw and firewalld

1. Viewing Firewall Status

Command	Description	Output Example
ufw status	Displays the current status of ufw firewall	`Status: active Default: deny (incoming), allow (outgoing) New profiles: skip`
ufw status verbose	Displays detailed firewall rules with more information	`Status: active Default: deny (incoming), allow (outgoing) New profiles: skip To Action From -- ------ ---- 22 ALLOW Anywhere 80 ALLOW Anywhere 443 ALLOW Anywhere`
ufw status numbered	Shows rules with line numbers for easier editing	`Status: active Default: deny (incoming), allow (outgoing) New profiles: skip To Action From -- ------ ---- [ 1] 22 ALLOW Anywhere [ 2] 80 ALLOW Anywhere [ 3] 443 ALLOW Anywhere`
firewall-cmd --state	Checks if firewalld is running	`running`
firewall-cmd --list-all	Lists all active zones and their rules	`public (active) target: default icmp-block-inversion: no interfaces: eth0 sources: services: ssh http https ports: masquerade: no forward-ports: source-ports: rules: ebtables: trusted:`

Example: Check ufw status

ufw status

Example: Check firewalld state

firewall-cmd --state

2. Enabling and Disabling Firewall

Command	Description	Notes
ufw enable	Enable the ufw firewall	Requires root privileges
ufw disable	Disable the ufw firewall	Stops all active rules
ufw status	Check the current status of ufw	Shows enabled/disabled state and active rules
ufw status verbose	Verbose status output including rule details	Useful for debugging firewall issues
firewall-cmd --reload	Reload firewalld configuration	Applies changes without restarting service
firewall-cmd --runtime-to-permanent	Save current runtime rules to permanent config	Makes changes persistent across reboots

Example: Enabling ufw firewall

sudo ufw enable

Example: Disabling ufw firewall

sudo ufw disable

Example: Checking ufw status

sudo ufw status

Example: Reloading firewalld

sudo firewall-cmd --reload

3. Allowing Ports

Command	Description	Example
ufw allow	Allow incoming connections on a specific port or service	`ufw allow 80/tcp`
ufw allow from	Allow connections from a specific IP address or subnet	`ufw allow from 192.168.1.0/24 to any port 22`
ufw allow in	Allow traffic on an interface (e.g., eth0)	`ufw allow in on eth0`

Example: Allow HTTP traffic

ufw allow 80/tcp
ufw allow 443/tcp

Example: Allow SSH from a specific IP

ufw allow from 10.0.0.5 to any port 22

Note: When using ufw allow, you can specify protocols like tcp or udp. If omitted, it defaults to tcp.

Warning: Be cautious when allowing ports; ensure that only necessary services are exposed to prevent security vulnerabilities.

4. Denying Ports

Command	Description	Example
ufw deny	Deny incoming connections to a specific port or service	`ufw deny 22`
ufw deny from	Deny incoming connections from a specific IP address or subnet	`ufw deny from 192.168.1.100 to any port 80`
ufw deny in	Deny incoming traffic on a specific interface	`ufw deny in on eth0 to any port 22`

Example: Deny incoming SSH access

ufw deny 22

Example: Deny traffic from a specific IP

ufw deny from 10.0.0.50 to any port 80

Note: Denying traffic will block all incoming connections to the specified port or IP address. Ensure you have alternative access methods (e.g., console access) before applying deny rules.

5. Allowing Services

Service	Port(s)	Protocol	Description
ssh	`22`	TCP	Secure Shell access to the system
http	`80`	TCP	Unencrypted web traffic (HTTP)
https	`443`	TCP	Encrypted web traffic (HTTPS)
ftp	`21`	TCP	File Transfer Protocol (control)
ftp-data	`20`	TCP	FTP data transfer (passive mode)
dns	`53`	UDP, TCP	Domain Name System resolution
ntp	`123`	UDP	Network Time Protocol synchronization
smtp	`25`	TCP	Simple Mail Transfer Protocol
imap	`143`	TCP	Internet Message Access Protocol
imaps	`993`	TCP	IMAP over SSL/TLS

Example: Allow SSH service

ufw allow ssh

Example: Allow HTTP and HTTPS services

ufw allow http
ufw allow https

Example: Allow specific port range (e.g., custom game server)

ufw allow 10000:20000/tcp

Note: When using firewalld, services are defined in XML configuration files under /usr/lib/firewalld/services/ or /etc/firewalld/services/. You can add new services or modify existing ones to define custom port ranges or protocols.

6. Deleting Rules

Rule Type	Command Syntax	Description
Delete by Position	`ufw delete POSITION`	Removes a rule at the specified position in the rule list
Delete by Rule	`ufw delete RULE`	Removes the first matching rule from the configuration
Delete All Rules	`ufw reset`	Removes all rules and resets to default policy

Example: Delete a specific rule by position

ufw delete 3

Example: Delete a rule by matching content

ufw delete allow from 192.168.1.100 to any port 22

Note: Use ufw status numbered to view rule positions before deletion.

Warning: Deleting rules does not automatically reload the firewall; use ufw reload if needed.

7. Configuring Default Policies

Policy	Description	Command	Notes
ufw default deny incoming	Deny all incoming connections by default	`ufw default deny incoming`	Blocks all incoming traffic unless explicitly allowed
ufw default allow incoming	Allow all incoming connections by default	`ufw default allow incoming`	Allows all incoming traffic unless explicitly blocked
ufw default deny outgoing	Deny all outgoing connections by default	`ufw default deny outgoing`	Blocks all outgoing traffic unless explicitly allowed
ufw default allow outgoing	Allow all outgoing connections by default	`ufw default allow outgoing`	Allows all outgoing traffic unless explicitly blocked

Example: Setting Default Incoming Policy to Deny

ufw default deny incoming

Example: Setting Default Outgoing Policy to Allow

ufw default allow outgoing

Note: After setting default policies, you must explicitly allow or deny specific services or ports to control traffic.

8. Managing Zones

Example: List available zones

ufw app list

Zone	Description	Default Policy
public	For use in public areas	`deny`
internal	For use on internal networks	`allow`
dmz	For use on DMZ (demilitarized zone) networks	`allow`
work	For use on work networks	`allow`
home	For use on home networks	`allow`
trusted	For use on trusted networks	`allow`

Note: Zones are predefined application profiles that define which services are allowed through the firewall.

Example: Set default zone

ufw default deny incoming
ufw default allow outgoing

Example: Allow traffic from specific zone

ufw allow from 192.168.1.0/24 to any port 80

9. Creating Rich Rules

Rule Type	Description	Example
ufw default deny incoming	Deny all incoming traffic by default	`ufw default deny incoming`
ufw default allow outgoing	Allow all outgoing traffic by default	`ufw default allow outgoing`
ufw allow from 192.168.1.0/24 to any port 22	Allow SSH access from a specific subnet	`ufw allow from 192.168.1.0/24 to any port 22`
ufw deny from 10.0.0.0/8 to any port 80	Deny HTTP access from a specific subnet	`ufw deny from 10.0.0.0/8 to any port 80`
ufw allow proto tcp from any to any port 443	Allow TCP traffic on port 443 (HTTPS)	`ufw allow proto tcp from any to any port 443`

Example: Allow SSH from specific IP

ufw allow from 192.168.1.100 to any port 22

Example: Block traffic from a specific IP

ufw deny from 10.0.0.5 to any port 22

Note: Rich rules in ufw are more flexible than basic port rules and allow for granular control over traffic based on source, destination, protocol, and port.

10. Saving Firewall Rules

Command	Description	Notes
sudo ufw save	Save the current ufw configuration to disk	Configuration is saved to `/etc/ufw/user.rules`
sudo ufw status verbose	Display current rules with detailed information	Shows rule numbers and status
sudo firewall-cmd --runtime-to-permanent	Save runtime firewalld configuration to permanent	Applies changes to `/etc/firewalld/zones/public.xml`

Example: Save ufw rules to disk

sudo ufw save
# Output: Rules changed.
# Configuration saved to /etc/ufw/user.rules

Example: Save firewalld runtime rules permanently

sudo firewall-cmd --runtime-to-permanent
# Output: success

Note: ufw rules are automatically saved when enabled/disabled, but manual save is recommended after major changes.

Warning: Without saving, firewall rules will be lost after reboot.