How to Configure your Linux Firewall – 3 Methods

A Linux firewall is essential for protecting your system from unauthorized access and attacks. By configuring firewall rules, you can control the flow of traffic into and out of your system. Linux offers multiple firewall management tools, including iptables and firewalld, both of which can be used to manage and secure your network.

Setting up a firewall in Linux is an essential step to protect your system from unauthorized access and potential threats. Firewalls act as a barrier between your internal network and external connections, filtering traffic based on predefined rules. These firewalls help your system or server by keeping it safe and secure.

In this guide, we are going to show you how to set up a firewall in Linux that will enable your system to be safe and secure in no time.

What is a Firewall?

A firewall is a security system designed to monitor and control incoming and outgoing network traffic. Acting as a barrier between trusted internal networks and untrusted external connections, firewalls enforce predefined security policies. Firewalls can be implemented in both hardware and software, with the main goal being to:

• Restrict unauthorized access.
• Allow legitimate communication.
• Prevent data breaches.

Types of Linux Firewalls

iptables

• iptables is the most widely used firewall tool in Linux. It works by defining chains of rules that filter network traffic at various points (such as incoming or outgoing traffic). iptables operates at the network layer (Layer 3) and transport layer (Layer 4).

firewall

• firewalld is a more modern firewall management tool for Linux, available on distributions like CentOS, RHEL, and Fedora. It provides a more dynamic and user-friendly approach to managing firewall rules using zones.

nftables

• nftables is the successor to iptables and provides an improved, more efficient way to filter network traffic. It is designed to replace iptables in newer Linux distributions.

How Does a Linux Firewall Work?

A Linux firewall filters network traffic based on a series of rules. These rules specify which types of network packets (data sent over the network) are allowed or denied based on factors like:

• IP Address: The source or destination address of the packet.
• Port Number: The communication port the packet is trying to reach (e.g., port 80 for HTTP or port 22 for SSH).
• Protocol: The type of network protocol used (TCP, UDP, ICMP, etc.).
• Connection State: Whether the packet is part of an established connection or is a new connection request.

When a packet enters or exits the system, the firewall checks it against its rules to determine whether it should be allowed to pass or blocked. If a packet matches an “allow” rule, it is allowed to pass. If it matches a “deny” rule, it is blocked.

Note: All the command below need sudo privileges.

Understanding Firewall Tools

Before getting into the configuration, let’s understand the common firewall tools available on Linux systems:

• iptables: A powerful command-line tool that filters network traffic. It works by defining chains of rules for different types of network traffic.
• ufw (Uncomplicated Firewall): A user-friendly frontend for iptables, simplifying configuration.
• firewalld: A dynamic firewall management tool, offering flexible configuration. It uses zones to define trust levels for network connections and interfaces, providing a simpler method to manage firewall settings compared to iptables.
• CSF (ConfigServer Security & Firewall): A complete security solution, including firewall features.
• ClearOS and OPNsense: Firewall-focused operating systems providing web-based interfaces.

Comparison of Firewall Tools

Method 1: Configuring Firewall with iptables

iptables is a powerful tool for configuring packet filtering and NAT rules. It’s ideal for experienced Linux users and system administrators managing complex environments.

iptables operates on a three-tiered system:

1. Tables: These are categorized groups of rules. Each table handles a specific type of packet:

• INPUT: Incoming packets destined for the local machine.
• OUTPUT: Outgoing packets originating from the local machine.
• FORWARD: Packets routed through the machine.

2. Chains: These are sequences of rules within a table. Packets are processed through a chain until a matching rule is found, determining the packet’s fate.

3. Rules: These are the individual instructions within a chain. Each rule has conditions (matching criteria) and targets (actions to take). Common actions include:

• ACCEPT: Allow the packet to pass.
• DROP: Discard the packet silently.
• REJECT: Discard the packet and send an error message.
• LOG: Log information about the packet.
• JUMP: Redirect the packet to another chain.

Note: You need to keep in mind a simple rule here – The Rules you set in the iptables are checked from the topmost rules to the bottom. Whenever a packet passes any of the top rules, it is allowed to pass the firewall. The lower rules are not checked. So be careful while setting up rules.

Step 1: Check Current Rules

Run sudo iptables -Lto list current firewall rules.
This lists all rules for INPUT (incoming), FORWARD (forwarding), and OUTPUT (outgoing) chains.

sudo iptables -L

Now the output will show three chains (INPUT, FORWARD, OUTPUT). We can also see column headers, but they are no actual rules. This is because most of the Linux come with no predefined rules.

Let see what each column mean:

• Target: This defines what action needs to be done on the packet (ACCEPT,DROP,etc..)
• prot: This defines the protocol (TCP,IP) of the packet.
• source: This tells the source address of the packet.
• destination: This defines the destination address of the packet

Step 2: Clear Existing Rules

If you want to clear/flush out all the existing rules. Run the following command if you want to Reset all current rules to start fresh:

sudo iptables -F

Step 3: Changing the Default Policy of Chains

As you can see in the above picture, the default policy of each of the chain is ACCEPT.

sudo iptables -P Chain_name Action_to_be_taken

Example: If you see the forward chain, you will see “Chain FORWARD (policy ACCEPT)”. This means your computer allows any traffic to be forwarded to another computer.

In order to change the policy of forwarding to drop:

sudo iptables -P FORWARD DROP

The above command will stop any traffic to be forwarded through your system. That means no other system can your system as an intermediary to pass the data.

Step 4: Implementing a DROP Rule

We’ll now start building our firewall policies. We’ll first work on the input chain since that is where the incoming traffic will be sent through.

Syntax:

sudo iptables -A/-I chain_name -s source_ip -j action_to_take

Example

Let’s assume we want to block the traffic coming from an IP address 192.168.1.3.

The following command can be used:

sudo iptables -A INPUT -s 192.168.1.3 -j DROP

This may look complicated, but most of it will make sense when we go over the components:

-A INPUT

• The flag -A is used to append a rule to the end of a chain. This part of the command tells the iptable that we want to add a rule to the end of the INPUT chain.

-I INPUT

• In this flag the rules are added to the top of the chain.

-s 192.168.1.3

• The flag -s is used to specify the source of the packet. This tells the iptable to look for the packets coming from the source 192.168.1.3

-j DROP

• This specifies what the iptable should do with the packet. In short, the above command adds a rule to the INPUT chain which says, if any packet arrives whose source address is 192.168.1.3 then drop that packet, that means do not allow the packet reach the computer.

Once you execute the above command you can see the changes by using the command:-

sudo iptables -L

The Output would be:

Step 5: Implementing a ACCEPT Rule

If you want to add rules to specific ports of your network,then the following commands can be used.

Syntax:

sudo iptables -A/-I chain_name -s source_ip -p protocol_name --dport port_number -j Action_to_take

-p protocol_name:

This option is used to match the packets that follow the protocol protocol_name.

-dport port_number:

This is option is available only if you give the -p protocol_name option. It specifies to look for the packets that are going to the port “port_number”.

Example:

Let’s say we want to keep our SSH port open (we will assume in this guide that the default SSH port is 22) from the 192.168.1.3 network we blocked in the above case. That is we only want to allow those packets coming from 192.168.1.3 and which wants to go to the port 22.

Let’s try the below command:

sudo iptables -A INPUT -s 192.168.1.3 -p tcp --dport 22 -j ACCEPT

The above command says looks for the packets originating from the IP address 192.168.1.3, having a TCP protocol and who wants to deliver something at the port 22 of my computer. If you find those packets then Accept them.

Here is the Output:

Troubleshooting the Problem with the Above Command

It actually does not allow the packets. Can You Guess What it is?

The Rules you set in the iptables are checked from the top to the bottom. Whenever a packet is processed to one of the top rules, it is not checked with the lower rules. Okay! Here’s The Answer:- In our case, The packet was checked with the topmost rule, which says that the iptable must drop any packet coming from 192.168.1.3. Hence once the packet got accessed through this rule, it did not go to the next rule which allowed packets to the port 22. Therefore it failed.

How to Fix?

The easiest answer is, Add the rule to the top of the chain. All you need to do is change the -A option to -I option.

( In our scenario we first delete the rule [refer the next section] added in the above section and then add the below rule again )

The command to do that is

sudo iptables -I INPUT -s 192.168.1.3 -p tcp --dport 22 -j ACCEPT

Now check the iptable configuration using -L command. The output would be:

Therefore, any packet coming from 192.168.1.3 is first checked if it is going to the port 22 if it isn’t then it is run through the next rule in the chain. Else it is allowed to pass the firewall. Now that you have understood how to block and accept the incoming traffic let’s see how to delete rules:

Deleting a Rule from the iptable (Optional)

If you want to delete the rule which accepts the traffic, Please follow the below example to understand it properly:

Syntax:

sudo iptables -D chain_name rule_number

Example:

Now lets learn it from example of deleting the rule which accepts the traffic to port 22 (Ref: In our Last Example, we added the Port 22)

Run the following command:

sudo iptables -D INPUT 1

Remember the rule number starts from 1

Output:

Step 6: Saving your Configuration

This part is unnecessary if you are implementing it on a personal computer which is not a server, but if you are implementing a firewall on a server, then there are high chances that your server might get corrupted and you might lose all your data. So, it’s always better to save your configurations. There are a lot of ways to do this, but the easiest way you could find is with iptables-persistent package.

You can download the package from Ubuntu’s default repositories:

sudo apt-get update sudo apt-get install iptables-persistent

Once the installation is complete, you can save your configuration using the command:-

sudo invoke-rc.d iptables-persistent save

Well, this is the end of the tutorial. Let’s just brief up all the commands we have learned so far:-

Method 2: Configuring Firewall with firewalld

firewalld simplifies managing rules by grouping them into zones (e.g., public, work, home).

Step 1: Install firewalld

Use the following command to Install firewalld

sudo apt-get install firewalld

sudo systemctl start firewalld

sudo systemctl enable firewalld

Step 2: Assign Network Interfaces to Zones

Lets learn this with an example, Assign eth0 to the “public” zone:

Cop the following command:

sudo firewall-cmd --zone=public --add-interface=eth0 --permanent

Step 3: Allow Services in Zones

Example: Permit HTTP traffic in the “public” zone:

sudo firewall-cmd –zone=public –add-service=http –permanent

sudo firewall-cmd –reload

Step 4: View Active Zones and Rules

sudo firewall-cmd –get-active-zones

sudo firewall-cmd –list-all

Above we have learned how to configure your Linux Firewall using the firewalld method from example where we Created a “home” zone that allows only trusted devices while blocking all external access.

Method 3: Configuring Firewall with UFW (Uncomplicated Firewall)

UFW is beginner-friendly and ideal for quick firewall setups, lets learn this configuration setup by an example of quickly setting up a secure environment for a personal Linux machine.

Step 1: Enable UFW

sudo ufw enable

Step 2: Allow Specific Services

Permit SSH:

sudo ufw allow ssh

Step 3: Block Traffic to Specific Ports

Example: Block traffic to port 8080:

sudo ufw deny 8080

Step 4: View Status

sudo ufw status

Conclusion

Linux firewalls are a vital layer of security for your system or server. By understanding the tools and following the methods outlined here, you can configure a firewall to safeguard against unauthorized access and attacks. Whether you choose iptables for advanced control, firewalld for dynamic management, or UFW for simplicity, each approach ensures your system remains secure.

Regular updates, testing, and monitoring will keep your firewall effective over time.

Common Mistakes to Avoid

• Not Saving Rules: Forgetting to save changes leads to loss of configurations after a reboot.
• Over-Blocking Traffic: Be cautious when setting DROP rules to avoid locking yourself out.
• Misapplying Zones (firewalld): Ensure interfaces are assigned to the correct zone.

Tips for Effective Firewall Management

1. Understand Your Network Needs

Identify which ports and services are required for your system and block the rest.

2. Use Logging for Monitoring

Enable logging to track allowed and blocked traffic for better troubleshooting.

• For firewalld

sudo firewall-cmd --set-log-denied=all

• For iptables

Use the LOG target to record dropped packets.

3. Test Firewall Rules

Use tools like nmap to scan your system and verify that only intended ports are open.

4. Automate Rule Application

Write startup scripts or use tools like Ansible to automate firewall configurations.

Conclusion

By following this guide, you can easily setup a firewall in Linux to protect your system from potential security threats. Whether you’re configuring simple or advanced firewall rules, using UFW or other tools, a well-configured firewall can significantly improve your system’s security.

All you need is a regular update on firewall and just by monitoring it will ensure that your Linux system remains safe from unauthorized access and cyber attacks.