mrvitej.in

Archive · Linux

Host Firewalls: ufw and firewalld

Allow only the ports you intend to serve, on Ubuntu and on CentOS.

1 min read

  • Ubuntu 18.04.3 LTS
  • ufw 0.36
  • CentOS 7.7
  • firewalld 0.6

Ubuntu ships ufw, a simple front end for iptables. CentOS uses firewalld. Both are off or permissive until you configure them.

# Ubuntu 18.04
sudo ufw default deny incoming
sudo ufw allow OpenSSH
sudo ufw allow 443/tcp
sudo ufw enable            # allow SSH first, or you lose your session
sudo ufw status verbose
# CentOS 7
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

The rule that matters: default deny, then allow what you serve. Always allow SSH before enabling a firewall on a remote machine. Cloud security groups add a second layer in front of the host, so the host firewall is defence in depth rather than the only barrier.