Cyber Security Academy · Lesson

iptables and UFW Firewall Rules

Write firewall rules to allow, deny, and log traffic using iptables and the simpler UFW interface.

iptables and UFW Firewall Rules is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Linux Firewalls Overview

Linux filters network traffic via the netfilter kernel framework. iptables is the traditional userspace tool; nftables is its modern replacement. UFW (Uncomplicated Firewall) is a simplified frontend for iptables, ideal for Ubuntu/Debian servers.

iptables Chains

iptables uses chains to process packets:

INPUT — packets destined for the local machine
OUTPUT — packets originating from the local machine
FORWARD — packets being routed through the machine

Rules in each chain are evaluated top-to-bottom; first match wins.

Default iptables Policies

The default policy applies when no rule matches. Secure default:

# Default deny all, allow established connections
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT

Common iptables Rules

Essential allow rules:

# Allow SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# Allow HTTP/HTTPS
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
# Allow from specific IP
iptables -A INPUT -s 10.0.0.5 -j ACCEPT
# List rules
iptables -L -n -v --line-numbers

Saving and Persisting iptables Rules

iptables rules are not persistent by default — they reset on reboot:

# Debian/Ubuntu:
aptitude install iptables-persistent
netfilter-persistent save
# RHEL/CentOS:
service iptables save

UFW Basics

UFW simplifies firewall management on Ubuntu. Common workflow:

ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable
ufw status verbose

UFW Application Profiles

UFW supports named profiles that open required ports for applications:

ufw app list
ufw allow "Nginx Full"     # opens 80 and 443
ufw allow "OpenSSH"
ufw app info "Nginx Full"

UFW Rate Limiting

UFW can rate-limit connections to prevent brute-force attacks:

# Allow SSH but rate-limit (max 6 connections per 30 seconds per IP)
ufw limit ssh
# This triggers after 6 connection attempts in 30 seconds

Logging Firewall Events

Enable logging to audit blocked traffic:

ufw logging on
ufw logging medium
# Logs appear in /var/log/ufw.log
tail -f /var/log/ufw.log | grep BLOCK

nftables: The Modern Alternative

nftables replaces iptables in modern Linux distributions. It uses a cleaner syntax and better performance for complex rulesets:

nft list ruleset
nft add rule inet filter input tcp dport 22 accept
nft add rule inet filter input drop

Stateful vs Stateless Firewalls

Stateful firewalls track connection state (NEW, ESTABLISHED, RELATED) — allow replies to outgoing connections automatically. Stateless rules match each packet independently, requiring explicit rules for both directions. Linux netfilter is stateful via the conntrack module.

Quick Check: Firewall Rules

Which UFW command sets a default policy to block all incoming connections unless explicitly allowed?

Lesson Recap

iptables (and modern nftables) control Linux packet filtering via INPUT/OUTPUT/FORWARD chains. UFW simplifies this with named profiles, rate limiting, and logging. Default policy should be deny incoming. Always allow established connections and loopback. Persist rules to survive reboots.

Frequently asked questions

Is the “iptables and UFW Firewall Rules” lesson free?

Yes — the full text of “iptables and UFW Firewall Rules” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “iptables and UFW Firewall Rules”?

Write firewall rules to allow, deny, and log traffic using iptables and the simpler UFW interface. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “iptables and UFW Firewall Rules” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy