Skip to main content
So what’s a firewall? A firewall is a security barrier—either software or hardware—that sits between your systems and the network (including the internet) and enforces policies about which traffic is allowed or denied. It inspects, monitors, and controls network traffic entering and leaving a host or network according to configured rules.
A diagram showing a desktop computer inside a dashed boundary with a brick-and-shield firewall icon between it and a Wi‑Fi router. The caption says the firewall "acts like a barrier between the system and the internet."
Think of a firewall like a home security system that watches doors and windows: keep most entry points closed and open only what you need. Firewalls come in two common forms:
  • Host-based software firewalls (typical for desktops and individual servers).
  • Dedicated hardware appliances (common in enterprise and datacenter networks).
Debian- and Ubuntu-based distributions commonly use UFW (Uncomplicated Firewall) to configure host firewall rules. UFW is a simpler front end to the kernel-level packet filters (historically iptables; many modern systems use nftables underneath). By default UFW is disabled, so enabling and tightening it is a basic hardening step—allowing only required traffic.
The image shows a "Firewall" screen with the Debian and Ubuntu logos side by side. Below them is a button labeled "Uncomplicated Firewall (UFW)" and a note stating the firewall is off by default but can be enabled.
Red Hat family distributions (RHEL, CentOS, Fedora) typically use FirewallD as the management tool. FirewallD also sits on top of the kernel packet filtering stack (iptables/nftables). If FirewallD is not already installed, you can add it through your package manager.
A slide titled "Firewall" showing the Red Hat and Fedora logos side by side, with notes below saying to install via YUM if needed and that iptables comes pre-installed in all Linux distros.
Host firewalls are also available on Windows and macOS. Windows Firewall is usually enabled by default; on macOS you can enable the firewall in System Settings. Regardless of platform, enabling a host firewall and restricting unnecessary ports is a fundamental security practice. Ports — what are they? A port is a network communication endpoint used by services to send and receive data. If a computer is a house, ports are the doors or windows: keep most closed and open only the ones needed. When you browse HTTPS websites, your browser typically connects to port 443. SSH commonly uses port 22, RDP uses port 3389, and so on. You don’t need to memorize every port—focus on the ones you use.
A presentation slide titled "Common Ports" listing network services with their default port numbers (e.g., HTTP 80, HTTPS 443, SMTP 25, SSH 22, MySQL 3306, RDP 3389, FTP 21, DNS 53, PostgreSQL 5432, Redis 6379, Kubernetes API 6443).
Quick reference table — common ports to know: To host a website to the public, you generally need only HTTP (80) and HTTPS (443) open. If you must open other ports, reduce risk by:
  • Restricting access by client IP (whitelisting).
  • Placing services behind a VPN, reverse proxy, or load balancer.
  • Using a Web Application Firewall (WAF) to block malicious requests and allow legitimate traffic.
A simple diagram showing multiple client computers (two with green checkmarks and one with a malicious/hacker icon) sending requests through a Web Application Firewall (illustrated as a flaming brick wall) to reach origin servers. The WAF blocks the malicious request (red X) while allowing the legitimate ones.
Important: always open your remote access port before enabling a firewall on a remote server—otherwise you may lock yourself out.
Before enabling a firewall on a remote system, ensure your remote access port (for example SSH on port 22) is allowed. If you enable the firewall without allowing your remote access, you could lose remote access to the machine.
UFW (Debian/Ubuntu) — basic commands Run these on Debian/Ubuntu-based systems to allow the most common access and enable the firewall. Always allow remote access first on remote machines.
  • Allow SSH (important to run first on remote servers):
  • Allow HTTP and HTTPS:
  • Enable the firewall:
  • Check status (human-readable):
  • Show rules with numbering (useful for deleting a rule):
  • Delete a rule by its number (example deleting rule number 3):
Tip: you can also delete a rule by specifying it, for example:
FirewallD (RHEL/CentOS/Fedora) — basic commands Install, start, and enable FirewallD:
(On newer Fedora/RHEL systems, use dnf instead of yum.) Open a port permanently (example: open port 443/tcp) and reload:
Remove a permanent port and reload:
Query runtime or permanent rules and the default zone:
Combined quick example for FirewallD:
Inspecting listening ports and connections Firewalls control what traffic can get to your host, but you also need to know which services are actually listening on which ports. Tools to inspect sockets:
  • ss (modern, recommended): ss -tulnp shows TCP/UDP listening sockets with process info.
  • netstat (older, from net-tools): sudo netstat -nltup shows listening sockets and owning processes.
Install net-tools if needed:
Common netstat usage:
Flags explained:
  • -n — show numeric addresses (no DNS lookups)
  • -l — show listening sockets
  • -t — TCP
  • -u — UDP
  • -p — show PID/program name
Remember: a firewall may permit a port, but if no service is listening that port is effectively closed. Conversely, a service can be listening but unreachable because a firewall blocks it. When troubleshooting connectivity, combine checks:
  • Firewall rules: sudo ufw status, sudo firewall-cmd --list-all
  • Socket/listener status: ss -tulnp or sudo netstat -nltup
Practice these commands on a test machine before applying them to production systems. Further reading and references Now that you understand firewalls, ports, and the common inspection tools, try these commands in a safe test environment to reinforce the concepts.

Watch Video