32. Linux and Network Hardening

32.3 Host Firewall: firewalld and ufw

By Ravindra Bagale · Last updated: 27 September 2026

A security group filters traffic outside the instance; a host firewall filters it inside the OS – a second layer.

firewalld (Amazon Linux, RHEL, CentOS):

sudo yum install -y firewalld
sudo systemctl enable firewalld
sudo service firewalld start
sudo firewall-cmd --get-default-zone
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --permanent --remove-service=cockpit     # remove what you do not need
# Allow MySQL only from the web server IP
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.1.25" port port="3306" protocol="tcp" accept'
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

ufw (Ubuntu, Kali):

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80,443/tcp
sudo ufw enable
sudo ufw status verbose