Linux Host Firewalls Hands-On: iptables, nftables, firewalld and UFW

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. Everyday example

Your EC2 web box already has a Security Group. Still, a stray process binds :9000 on the host. Same-SG peers can reach it. Host firewall is the apartment lock after the building gate. Sneha closes 9000 with ufw; Lucas prefers nftables on Debian bastions.

2. Why a host firewall when SG exists?

Why do we need this?

• Same-SG or same-subnet peers bypass "internet" thinking
• Bastions and jump boxes need OS-level deny by default
• Containers/VMs on metal still need a local policy
• Compliance often asks for host-based controls too

3. Tool map

4. iptables hands-on

What is it?

iptables talks to netfilter. Common filter table chains: INPUT (to this host), OUTPUT (from this host), FORWARD (through this host). Policies are ACCEPT or DROP.

How to do it (step by step)

# View rules (filter table)
sudo iptables -L -n -v --line-numbers
# sample output meaning:
# Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
# num  pkts bytes target  prot  opt  in  out  source      destination
# 1       0     0 ACCEPT  tcp   --   *   *    0.0.0.0/0   0.0.0.0/0   tcp dpt:22
# → line 1 allows SSH (tcp/22) from anywhere

# Default deny incoming (careful: keep SSH allowed first!)
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
# OUTPUT often left ACCEPT for beginners

# Delete a line
sudo iptables -D INPUT 3

Persist (Debian/Ubuntu): sudo apt install iptables-persistent && sudo netfilter-persistent save. RHEL: write a service or migrate to nft/firewalld.

5. nftables hands-on

# List
sudo nft list ruleset
# sample: table inet filter { chain input { type filter hook input priority 0; policy drop;
#   ct state established,related accept
#   tcp dport 22 accept
# } }

# Quick inet filter (IPv4+IPv6)
sudo nft add table inet filter
sudo nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'
sudo nft add rule inet filter input ct state established,related accept
sudo nft add rule inet filter input iif lo accept
sudo nft add rule inet filter input tcp dport 22 accept
sudo nft add rule inet filter input tcp dport 80 accept

# Persist: save to /etc/nftables.conf and enable nftables.service
sudo nft list ruleset | sudo tee /etc/nftables.conf
sudo systemctl enable --now nftables

6. firewalld hands-on

# State and default zone
sudo firewall-cmd --state
# running
sudo firewall-cmd --get-default-zone
# public

# Allow HTTP permanently and reload
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-all
# sample: public (active)
#   services: cockpit dhcpv6-client http ssh
#   ports: 8080/tcp
# → http and 8080 are allowed in zone public

# Rich rule example: allow 10.0.0.0/24 to 3306
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/24 port port=3306 protocol=tcp accept'
sudo firewall-cmd --reload

7. ufw hands-on

sudo ufw status verbose
# Status: inactive

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
# or: sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
# Command may ask for confirmation — say y

sudo ufw status numbered
# [ 1] 22/tcp ALLOW IN Anywhere
# [ 2] 80/tcp ALLOW IN Anywhere
# → SSH and HTTP allowed; everything else incoming denied by default

# Delete rule number 2
sudo ufw delete 2

ufw writes under /etc/ufw/; enabled means persistent across reboot.

8. Test with curl and nc

How to do it (step by step)

# From a second host (or your laptop if SG allows)
curl -s -o /dev/null -w "%{http_code}\n" http://TARGET/
# 200 → web allowed; 000 / timeout → blocked or down

nc -vz TARGET 22
# Connection to TARGET 22 port [tcp/ssh] succeeded!
nc -vz TARGET 9000
# nc: connect to TARGET port 9000 (tcp) failed: Connection refused / timed out
# → refused often means nothing listening; timed out often means filtered (FW)

# On the target, watch drops (nft example)
sudo nft monitor | head

9. Make rules persistent — cheat sheet

10. Multi-industry snapshots

• Clinic (Adaeze): ufw on Ubuntu imaging PACS jump box; only 22 from bastion IP.
• Fintech (Arjun): nftables on hardened Debian bastions; firewalld on Rocky app nodes.
• Ecommerce (Lucas): ufw on build agents; deny all except CI subnet.
• Uni lab (Sofia): firewalld zones — student wifi zone vs servers zone.

11. Lab: lock a lab VM then prove it

1. Snapshot / take AMI if this is a cloud VM.
2. Pick ONE tool (ufw on Ubuntu, firewalld on Rocky).
3. Allow SSH from your IP only; allow 80; default deny incoming.
4. curl :80 → 200; nc :9000 → fail; nc :22 from wrong IP → fail.
5. Reboot and re-run status — rules must survive.
6. Write the four proof lines in your notes.

Cleanup

1. If this was a throwaway VM, terminate it.
2. If shared, remove lab-only allows and leave SSH locked to bastion.

12. Side-by-side command map

13. Lab A — allow then prove

On a throwaway VM: start a tiny HTTP server, lock the host, open only one port, prove with curl and nc from another host.

# Terminal 1 (server)
python3 -m http.server 8080 --bind 0.0.0.0
# Terminal 2 (firewall) — ufw example
sudo ufw default deny incoming
sudo ufw allow OpenSSH
sudo ufw allow 8080/tcp
sudo ufw enable
sudo ufw status numbered
# Terminal 3 (client)
curl -v --max-time 3 http://SERVER_IP:8080/
nc -vz SERVER_IP 8080
nc -vz SERVER_IP 8081

Expected: 8080 returns HTTP; 8081 hangs or fails. If both work, default was still allow or another layer opened it.

14. Lab B — iptables to nftables migration sketch

# Export legacy
sudo iptables-save > /tmp/legacy.v4
iptables -V
sudo nft flush ruleset
sudo nft -f - <<'EOF'
table inet filter {
  chain input { type filter hook input priority 0; policy drop;
    ct state established,related accept
    iif lo accept
    tcp dport { 22, 80, 443 } accept
  }
  chain forward { type filter hook forward priority 0; policy drop; }
  chain output { type filter hook output priority 0; policy accept; }
}
EOF
sudo nft list ruleset
sudo nft list ruleset > /etc/nftables.conf
sudo systemctl enable --now nftables

15. Lab C — firewalld zones for a bastion

sudo firewall-cmd --get-active-zones
sudo firewall-cmd --set-default-zone=public
sudo firewall-cmd --permanent --zone=public --add-service=ssh
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="203.0.113.0/24" service name="ssh" accept'
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

16. Eight common errors (Linux FW)

17. Common errors and fixes

Each row is a real mistake students and juniors hit. Read the fix before you panic.

18. Troubleshooting Linux FW

19. Troubleshooting checklist

1. Is the daemon running? systemctl status firewalld|ufw|nftables
2. Which tool owns the stack? iptables -V; nft list ruleset; ufw status
3. Default policy ACCEPT or DROP?
4. Are you hitting INPUT or FORWARD (containers/bridges)?
5. Does curl fail with timeout (filtered) or connection refused (port closed but reachable)?
6. Check order: first matching rule wins in iptables/nft.

20. Firewall decision checklist

1. Write the threat in one sentence (scan, SQLi, malware DNS, lateral SSH).
2. Pick the layer: packet / stateful / proxy / NGFW / WAF / DNS / host.
3. Pick the form: host tool, network appliance, or cloud service.
4. Default deny or default allow? Write it down.
5. Plan allow tests and deny tests before go-live.
6. Plan logging destination (file, CloudWatch, SIEM).
7. Name the on-call for false positives.
8. Link the deep chapter you will not duplicate (SG/NACL, WAF, hardening).
9. Estimate monthly cost (especially Network Firewall).
10. Schedule a reboot or failover test for persistence.

21. Copy-paste quick commands

# --- Host (Ubuntu ufw) ---
sudo ufw status verbose
sudo ufw allow OpenSSH && sudo ufw allow 80/tcp && sudo ufw enable

# --- Host (RHEL firewalld) ---
sudo firewall-cmd --permanent --add-service=http && sudo firewall-cmd --reload

# --- Host (nft) ---
sudo nft list ruleset

# --- AWS pointers (details in linked chapters) ---
aws ec2 describe-security-groups --group-ids $SG
aws wafv2 list-web-acls --scope REGIONAL --region ap-south-1
aws network-firewall list-firewalls --region ap-south-1
aws route53resolver list-firewall-rule-groups --region ap-south-1

22. More industry stories

• Retail POS (Kenji, Osaka): host FW on till PCs; network FW between stores and HQ; WAF only on ecommerce, not on private VPN APIs.
• Media streaming (Priya, Pune): CloudFront+WAF for viewers; Network Firewall for origin admin VPC; Shield Advanced on match-day.
• Gov portal (Fatima, Rabat): FMS mandates WAF CRS + DNS Firewall across ministries; local teams cannot disable.
• Startup (Diego, São Paulo): start with SG+ufw+CloudFront WAF; add Network Firewall when east-west grows.
• Logistics (Mei, Singapore): DNS Firewall blocks sinkholes; Suricata drops known C2 on inspection VPC.

23. Glossary (short)

24. Practice: explain out loud

1. 60 seconds: building-guard story for firewall types.
2. 60 seconds: iptables vs nftables vs firewalld vs ufw.
3. 60 seconds: SG vs NACL vs Network Firewall vs WAF.
4. 60 seconds: inspection VPC with Transit Gateway.
5. Record yourself once; fix filler words; record again.

25. Safe lab hygiene

• Never practice DROP rules on a production SSH session without console access.
• Tag every cloud lab resource with owner and expiry.
• Keep a written rollback: old ruleset file or SG snapshot.
• Prefer allowlists over giant denylists when starting.
• After lab, delete Network Firewall — it bills hourly.

26. How this set links other chapters

• Networking basics / ports — foundations before filters.
• SG vs NACL class — stateful vs stateless on AWS VPC.
• Linux hardening survey — SELinux, fail2ban, auditd beyond FW.
• CloudFront+WAF survey — CDN/HTTPS + light WAF.
• WAF explained / hands-on / Shield / DDoS project — L7 and DDoS depth.

27. Rule-writing workshop

Write rules in English first, then translate to the tool. Bad: "block bad stuff". Good: "Drop TCP 445 from 0.0.0.0/0 on INPUT; allow TCP 445 only from 10.0.0.0/16".

1. Name the direction: inbound, outbound, or east-west.
2. Name the 5-tuple or domain or HTTP path.
3. Name the action: accept, drop, alert, challenge.
4. Name the hit counter / log you will check.
5. Name the rollback (previous ruleset file).
6. Peer-review with someone who did not write it.

28. Sample allow / deny matrix

29. Ten oral drill questions

1. Say three differences between packet filter and stateful.
2. Name four Linux host firewall tools.
3. Why does connection refused ≠ filtered?
4. What is an inspection VPC for?
5. When is UTM a good first buy?
6. Where do Suricata rules run on AWS?
7. What does Firewall Manager stop?
8. Why link SG vs NACL instead of rewriting?
9. Give one healthcare and one fintech firewall story.
10. What do you delete first in lab cleanup for cost?

30. Common errors and fixes

Each row is a real mistake students and juniors hit. Read the fix before you panic.

31. Troubleshooting checklist

1. Confirm which tool owns the host: nft list, iptables -L, firewall-cmd --state, ufw status.
2. Check SG/NACL on cloud before blaming host FW.
3. For DROP issues, briefly LOG prefix then DROP to see hits.
4. conntrack full? Check nf_conntrack_count vs max.
5. After changes, reboot once in lab to prove persist.

32. FAQ

33. Interview Q&A

34. Tips in English, Marathi and Hindi

Revision, interview and comparison cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.