Understanding Firewalls (UFW/firewalld)

Imagine your server as a house. A firewall acts like a security guard at the door, deciding who gets in and out. It's a critical part of server security.

Firewalls prevent unauthorized access and protect your server from malicious attacks by controlling network traffic.

Firewalls work by using a set of rules to inspect incoming and outgoing network traffic. These rules are based on:

• Source/Destination IP Address: Where traffic comes from or goes.
• Port Numbers: Specific 'doors' for services (e.g., port 22 for SSH, 80 for HTTP).
• Protocols: Like TCP or UDP.

They either allow or deny traffic that matches these rules.

On Debian-based systems like Ubuntu, the most common firewall tool is UFW, which stands for "Uncomplicated Firewall."

UFW is designed to be easy to use, making it simple for beginners to manage firewall rules without diving into complex `iptables` commands directly.

By default, UFW is configured for security:

• Deny Incoming: All incoming connections are blocked unless explicitly allowed.
• Allow Outgoing: Your server can initiate connections to the outside world.

This means you need to specifically open ports for services you want to be accessible from the internet, like a web server or SSH.

Before enabling UFW, it's crucial to allow SSH access, otherwise, you might lock yourself out of your server! After allowing SSH, you can enable UFW.

Try running these commands:

UFW can allow traffic for common services by their name (if defined in /etc/services) or by their port number. Let's allow HTTP (web traffic) and SSH:

Sometimes you need to open a specific port that isn't a standard named service, like port 8080 for a custom application. You can specify the protocol too (TCP or UDP).

Here's how to allow TCP traffic on port 8080:

On Red Hat-based systems like CentOS and Fedora, the firewall management tool is firewalld. It's a dynamic firewall daemon, meaning you can change rules without restarting the entire firewall service.

firewalld uses the concept of 'zones' to manage rules, which offers a more flexible approach to security.

firewalld organizes firewall rules into zones. Each zone has a default set of rules and can be assigned to network interfaces.

Common zones include:

• public: For untrusted networks (default for external interfaces).
• home/internal: For trusted networks.
• trusted: All network connections are accepted.

This allows you to apply different security levels based on the network's trust level.

To allow services with firewalld, you specify the service, the zone, and use the --permanent flag to make the rule persist after a reboot. You then need to reload firewalld.

Let's open SSH and HTTP in the public zone:

You've learned about UFW and firewalld. Which of the following statements about these firewall tools are TRUE?

Great job! You've learned about the vital role of firewalls in server security. You now understand:

• What firewalls are and why they are essential.
• How UFW works on Ubuntu/Debian, including enabling and allowing services.
• How firewalld works on CentOS/RHEL, its zone concept, and adding services.

Mastering these tools is crucial for controlling network access and keeping your server secure. Next, we'll dive into managing specific ports and their security implications!