- Implementing packet filtering using the netfilter kernel with tools such as UFW, firewalld, and iptables.
- Setting up a layered defense strategy that combines the cloud provider's firewall with internal system rules.
- Implementation of system hardening measures such as the principle of least privilege, secure SSH access, and frequent updates.
If you have a Linux server, you know that leaving it open to the elements is like leaving your front door unlocked in the middle of an unfamiliar city. To prevent any curious onlookers or attackers from getting in where they shouldn't, it's essential to set up a solid security perimeter , and that's where the firewall comes in—the guardian that decides who gets in and who stays out.
Setting up a firewall doesn't have to be a headache or a job for network experts. It's really just a matter of applying some common sense and following basic filtering rules to keep your services running smoothly without exposing your system to unnecessary risks. Let's break down how to secure your system from the ground up, including the most advanced tools.
What exactly is a firewall and how does filtering work?
Basically, a firewall is a system that monitors and controls the traffic entering and leaving your machine based on rules you define. In the Linux kernel, this is done by a component called netfilter , which resides within the kernel. It's important to understand that tools like ufw or firewalld are not the firewall itself, but rather user interfaces for easily managing netfilter.
The key process is packet filtering . Each piece of data is divided into packets, and the firewall analyzes the header to decide: accept (ACCEPT), drop (DROP), or warn and reject (REJECT). To do this, it looks at the IP address, port, and protocol.
First steps: Mapping cloud services and security
Before writing rules, it's essential to take inventory of services. The most common practice is to leave port 22 open for SSH and port 443 for HTTPS, while blocking everything else.
If you work with cloud servers, take advantage of the security groups offered by your provider. These external firewalls filter traffic before it reaches your server, and you only need to allow specific IPs for defense in depth and network segmentation.
Mastering Linux tools: iptables, UFW, and firewalld
Depending on the layout, you have different utilities available. iptables It's powerful but complex; you can use commands to open ports and block traffic, for example. iptables -A INPUT -p tcp --dport 22 -j ACCEPTTo avoid it being a nightmare, Ubuntu or Debian includes UFWVery simply put: it allows and denies services in a basic way. In environments with Red Hat, CentOS, or Fedora, you have firewalld and its trusted zones that simplify dynamic management.
Making the rules survive resets
If the configuration doesn't persist, everything will be lost upon reboot. In iptables, install iptables-persistent o iptables-services and save with iptables-saveThis way your firewall remains active after a reboot.
Beyond the firewall: Total terminal shielding
Not just the firewall: apply the principle of least privilege, review accounts, and update the system regularly. For remote access, disable root login and use public keys; add 2FA, and if it's a business, integrate EDR for real-time monitoring.
Testing and preventive maintenance
Never be overconfident: check with curl that the services respond, and with nmap From another machine, only the specified ports are open. Archive the rules and clean up old entries each month to maintain control.
In short, a layered firewall, with regular updates and auditors, turns your server into an impregnable fortress.
Passionate writer about the world of bytes and technology in general. I love sharing my knowledge through writing, and that's what I'll do on this blog, show you all the most interesting things about gadgets, software, hardware, tech trends, and more. My goal is to help you navigate the digital world in a simple and entertaining way.