Linux Host Firewalls Hands-On: iptables, nftables, firewalld आणि UFW

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. रोजचे उदाहरण

SG = building gate; host FW = apartment lock. Port 9000 बंद — ufw किंवा nftables.

2. SG असताना host FW का?

हे का लागतं?

• Peer lateral movement
• Bastion default deny
• Local policy
• Compliance

3. Tool map

4. iptables hands-on

हे काय आहे?

iptables → netfilter. INPUT/OUTPUT/FORWARD. Policy ACCEPT/DROP.

कसं करायचं (step by step)

# View rules (filter table)
sudo iptables -L -n -v --line-numbers
# sample output meaning:
# Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
# num  pkts bytes target  prot  opt  in  out  source      destination
# 1       0     0 ACCEPT  tcp   --   *   *    0.0.0.0/0   0.0.0.0/0   tcp dpt:22
# → line 1 allows SSH (tcp/22) from anywhere

# Default deny incoming (careful: keep SSH allowed first!)
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
# OUTPUT often left ACCEPT for beginners

# Delete a line
sudo iptables -D INPUT 3

Persist: iptables-persistent / netfilter-persistent. RHEL: service किंवा nft/firewalld.

5. nftables hands-on

# List
sudo nft list ruleset
# sample: table inet filter { chain input { type filter hook input priority 0; policy drop;
#   ct state established,related accept
#   tcp dport 22 accept
# } }

# Quick inet filter (IPv4+IPv6)
sudo nft add table inet filter
sudo nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'
sudo nft add rule inet filter input ct state established,related accept
sudo nft add rule inet filter input iif lo accept
sudo nft add rule inet filter input tcp dport 22 accept
sudo nft add rule inet filter input tcp dport 80 accept

# Persist: save to /etc/nftables.conf and enable nftables.service
sudo nft list ruleset | sudo tee /etc/nftables.conf
sudo systemctl enable --now nftables

6. firewalld hands-on

# State and default zone
sudo firewall-cmd --state
# running
sudo firewall-cmd --get-default-zone
# public

# Allow HTTP permanently and reload
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-all
# sample: public (active)
#   services: cockpit dhcpv6-client http ssh
#   ports: 8080/tcp
# → http and 8080 are allowed in zone public

# Rich rule example: allow 10.0.0.0/24 to 3306
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/24 port port=3306 protocol=tcp accept'
sudo firewall-cmd --reload

7. ufw hands-on

sudo ufw status verbose
# Status: inactive

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
# or: sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
# Command may ask for confirmation — say y

sudo ufw status numbered
# [ 1] 22/tcp ALLOW IN Anywhere
# [ 2] 80/tcp ALLOW IN Anywhere
# → SSH and HTTP allowed; everything else incoming denied by default

# Delete rule number 2
sudo ufw delete 2

ufw enable = reboot नंतरही rules.

8. curl आणि nc ने test

कसं करायचं (step by step)

# From a second host (or your laptop if SG allows)
curl -s -o /dev/null -w "%{http_code}\n" http://TARGET/
# 200 → web allowed; 000 / timeout → blocked or down

nc -vz TARGET 22
# Connection to TARGET 22 port [tcp/ssh] succeeded!
nc -vz TARGET 9000
# nc: connect to TARGET port 9000 (tcp) failed: Connection refused / timed out
# → refused often means nothing listening; timed out often means filtered (FW)

# On the target, watch drops (nft example)
sudo nft monitor | head

9. Persistent — cheat sheet

10. Multi-industry

• Clinic: ufw + bastion IP
• Fintech: nft + firewalld
• Ecommerce: ufw CI subnet
• Uni: firewalld zones

11. Lab: VM lock + proof

1. Snapshot/AMI.
2. एक tool.
3. SSH IP + 80; deny in.
4. Proof matrix.
5. Reboot persist.
6. Notes.

Cleanup

1. Throwaway → terminate.
2. Shared → tighten.

12. Command map

13. Lab A

Throwaway VM: HTTP server, lock, one port, curl/nc prove.

# Terminal 1 (server)
python3 -m http.server 8080 --bind 0.0.0.0
# Terminal 2 (firewall) — ufw example
sudo ufw default deny incoming
sudo ufw allow OpenSSH
sudo ufw allow 8080/tcp
sudo ufw enable
sudo ufw status numbered
# Terminal 3 (client)
curl -v --max-time 3 http://SERVER_IP:8080/
nc -vz SERVER_IP 8080
nc -vz SERVER_IP 8081

Expected: 8080 OK; 8081 fail. Both OK means default allow or another layer.

14. Lab B

# Export legacy
sudo iptables-save > /tmp/legacy.v4
iptables -V
sudo nft flush ruleset
sudo nft -f - <<'EOF'
table inet filter {
  chain input { type filter hook input priority 0; policy drop;
    ct state established,related accept
    iif lo accept
    tcp dport { 22, 80, 443 } accept
  }
  chain forward { type filter hook forward priority 0; policy drop; }
  chain output { type filter hook output priority 0; policy accept; }
}
EOF
sudo nft list ruleset
sudo nft list ruleset > /etc/nftables.conf
sudo systemctl enable --now nftables

15. Lab C

sudo firewall-cmd --get-active-zones
sudo firewall-cmd --set-default-zone=public
sudo firewall-cmd --permanent --zone=public --add-service=ssh
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="203.0.113.0/24" service name="ssh" accept'
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

16. Eight Linux FW errors

17. सामान्य errors आणि fixes

प्रत्येक row = खरी चूक. Panic करण्याआधी fix वाचा.

18. Troubleshooting

19. Troubleshooting checklist

1. Daemon status?
2. Who owns?
3. Default policy?
4. INPUT vs FORWARD
5. Timeout vs refused
6. First match wins

20. Firewall decision checklist

1. Threat एक वाक्य.
2. Layer निवडा.
3. Form निवडा.
4. Default policy.
5. Allow + deny tests.
6. Logging dest.
7. On-call.
8. Deep chapter link.
9. Cost estimate.
10. Persist test.

21. Copy-paste quick commands

# --- Host (Ubuntu ufw) ---
sudo ufw status verbose
sudo ufw allow OpenSSH && sudo ufw allow 80/tcp && sudo ufw enable

# --- Host (RHEL firewalld) ---
sudo firewall-cmd --permanent --add-service=http && sudo firewall-cmd --reload

# --- Host (nft) ---
sudo nft list ruleset

# --- AWS pointers (details in linked chapters) ---
aws ec2 describe-security-groups --group-ids $SG
aws wafv2 list-web-acls --scope REGIONAL --region ap-south-1
aws network-firewall list-firewalls --region ap-south-1
aws route53resolver list-firewall-rule-groups --region ap-south-1

22. अजून industry stories

• Retail: host+network; WAF ecommerce only
• Media: CF+WAF; NF admin; Shield
• Gov: FMS mandate
• Startup: grow into NF
• Logistics: DNS+Suricata

23. Glossary

24. Practice: मोठ्याने explain

1. 60s guard story.
2. 60s four tools.
3. 60s four AWS.
4. 60s inspection VPC.
5. Record ×2.

25. Safe lab hygiene

• Prod SSH + DROP = console.
• Tag owner+expiry.
• Rollback file.
• Allowlist first.
• NF hourly — delete.

26. या set ची links

• Networking basics
• SG vs NACL
• Hardening survey
• CF+WAF
• WAF/Shield set

27. Rule-writing workshop

आधी English rule, मग tool. वाईट: bad stuff. चांगले: Drop 445 except 10.0.0.0/16.

1. Direction.
2. Match fields.
3. Action.
4. Observability.
5. Rollback.
6. Peer review.

28. Allow / deny matrix

29. दहा oral drills

1. Packet vs stateful ×3.
2. Four Linux tools.
3. Refused ≠ filtered.
4. Inspection VPC.
5. UTM when.
6. Suricata on AWS.
7. FMS stops drift.
8. No duplicate.
9. Two industries.
10. NF hourly delete.

30. सामान्य errors आणि fixes

प्रत्येक row = खरी चूक. Panic करण्याआधी fix वाचा.

31. Troubleshooting checklist

1. कोणता tool owner?
2. आधी SG/NACL.
3. LOG then DROP.
4. conntrack full?
5. Reboot proof.

32. FAQ

33. Interview Q&A

34. Tips — English, मराठी आणि हिंदी

उजळणी, मुलाखत आणि तुलना cards

हा lesson काही मिनिटांत revise करा. Cards phone वर save करा किंवा PNG download करा. प्रत्येक card वरचा QR हा lesson उघडतो.

अजून cards: Ravi Sir's Cards.