sodcalculator

10 Tech How-To

Firewall Linux Setup: Step-by-Step Guide

Guide 10-20402 · Updated · Step by step

Setting up a firewall on Linux is one of the most effective ways to protect your system from unauthorized network access. This guide walks you through configuring a firewall using UFW (Uncomplicated Firewall) and firewalld, the two most common tools on modern distributions. You’ll learn how to enable, configure, and verify rules, and what to do if something goes wrong.

What You’ll Need

  • A Linux system (Ubuntu, Debian, CentOS, Fedora, or similar) with root or sudo access.
  • An active network connection (to test rules and avoid locking yourself out).
  • Basic familiarity with the command line.

Step-by-Step

  1. Identify your firewall tool. Most Ubuntu/Debian systems use UFW; CentOS/RHEL/Fedora use firewalld. Check with: sudo ufw status or sudo firewall-cmd --state. If neither is installed, install UFW with sudo apt install ufw (Debian/Ubuntu) or firewalld with sudo dnf install firewalld (Fedora/CentOS).
  2. Set default policies. For UFW: sudo ufw default deny incoming and sudo ufw default allow outgoing. For firewalld: sudo firewall-cmd --set-default-zone=public (the default zone already denies incoming, but you can verify with sudo firewall-cmd --get-default-zone).
  3. Allow essential services. Before enabling the firewall, allow SSH (port 22) to avoid being locked out. UFW: sudo ufw allow ssh. firewalld: sudo firewall-cmd --permanent --add-service=ssh. Also allow HTTP/HTTPS if running a web server: sudo ufw allow http and sudo ufw allow https (or --add-service=http etc. for firewalld).
  4. Enable the firewall. UFW: sudo ufw enable. firewalld: sudo systemctl enable --now firewalld.
  5. Add specific rules. For a custom port (e.g., 8080) with UFW: sudo ufw allow 8080/tcp. With firewalld: sudo firewall-cmd --permanent --add-port=8080/tcp, then reload with sudo firewall-cmd --reload.
  6. Check your rules. UFW: sudo ufw status verbose. firewalld: sudo firewall-cmd --list-all.
  7. Test from another machine. Try connecting to the allowed services (e.g., SSH). If you can’t, review the rules and your network configuration.

Common Mistakes

  • Enabling the firewall before allowing SSH – you lock yourself out.
  • Forgetting to reload firewalld after changes – rules don’t apply until you run sudo firewall-cmd --reload.
  • Using the wrong zone in firewalld – the public zone is typically correct for most setups.
  • Blocking ICMP (ping) accidentally – it’s useful for troubleshooting.
  • Allowing all incoming traffic instead of specific ports – defeats the purpose.

Tips

  • Start with a restrictive policy and open only what you need.
  • Use service names (like ssh) instead of port numbers when possible – they’re easier to remember.
  • For UFW, you can delete rules with sudo ufw delete allow 8080/tcp.
  • For firewalld, use --permanent for rules that survive a reboot.
  • Consider logging dropped packets (UFW: sudo ufw logging on) to debug issues.

Troubleshooting

If you lose SSH access after enabling the firewall, reboot the system – most firewalls don’t persist until you explicitly save them. For UFW, the default is to not enable on boot until you run sudo ufw enable, but if you did, you can reboot and then use a physical console to disable it (sudo ufw disable). For firewalld, run sudo systemctl stop firewalld from the console.

If a service isn’t reachable, check the firewall logs. UFW logs to /var/log/ufw.log. firewalld logs to the system journal: journalctl -u firewalld. Look for blocked packets and adjust rules accordingly.

If rules don’t seem to apply, ensure you’re using the correct zone (firewalld) or that you’ve reloaded. Also verify that the service is actually listening on the expected port: ss -tulpn.

Frequently Asked Questions

Do I need a firewall on Linux?

Yes, especially if your system is exposed to the internet. A firewall adds a layer of protection against unauthorized access.

What’s the difference between UFW and firewalld?

UFW is simpler and uses iptables underneath; firewalld uses zones and supports dynamic changes without reloading. Choose based on your distribution’s default.

Can I use both UFW and firewalld?

No, running both can cause conflicts. Stick with one.

How do I allow a port temporarily in firewalld?

Use sudo firewall-cmd --add-port=8080/tcp (without –permanent) – it lasts until the service is restarted.

How do I block an IP address?

UFW: sudo ufw deny from 192.168.1.100. firewalld: sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.1.100 drop'.

Will the firewall slow down my system?

Negligibly. Modern firewalls are very efficient and have minimal impact on performance.

Related

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →