防火墙管理：`ufw`、`firewalld`、`iptables`

A firewall acts as a security guard for your computer or network. It controls incoming and outgoing network traffic by analyzing data packets and deciding whether to allow or block them based on a set of predefined rules.

Think of it as a filter that protects your system from unauthorized access and malicious threats.

UFW, which stands for "Uncomplicated Firewall," is a user-friendly front-end for iptables, the complex default firewall utility in Linux. It's designed to make firewall management much simpler, especially for users on Debian-based systems like Ubuntu.

UFW simplifies common tasks like opening or closing ports.

Before making changes, it's good practice to check UFW's current status. You can also easily enable or disable it.

Try running these commands:

UFW allows you to open ports for common services by their name, which is very convenient. For example, to allow SSH or HTTP traffic, you just use the service name.

Let's try allowing SSH and HTTP:

Sometimes you need to open a specific port that isn't a named service. You can do this by specifying the port number and the protocol (TCP or UDP).

Here's how to allow port 8080 for TCP and 53 for UDP:

Firewalld is another popular firewall management tool, often found on Red Hat-based systems like CentOS and Fedora. Unlike UFW, Firewalld is a dynamic firewall manager.

It uses zones to define different trust levels for network connections, allowing you to apply rules based on where the connection originates.

With Firewalld, you can check its status and explore the various zones it uses. Zones like public, home, or internal have different default rules.

Check the status and active zones:

To manage services with Firewalld, you specify the zone and the service name. Changes are temporary by default; use --permanent to make them stick after a reboot, then --reload to apply.

Let's add HTTP service to the public zone permanently:

Similar to services, you can open or close specific port numbers in a Firewalld zone. Remember to specify the protocol (TCP or UDP) and use --permanent for lasting changes.

Here's how to open port 8080 for TCP permanently:

Time for a quick check! Which of the following statements about firewall management in Linux are true?

In this lesson, we explored how to manage firewalls on Linux systems to enhance security. We covered two main tools:

• UFW (Uncomplicated Firewall): A simple interface for iptables, popular on Debian/Ubuntu, allowing easy control over services and ports.
• Firewalld: A dynamic firewall manager used on RHEL/CentOS systems, which organizes rules into zones for flexible security policies.

Understanding these tools is crucial for securing your Linux server or workstation.