Cheat sheet

Firewalls with ufw and firewalld

Opening ports, blocking addresses and seeing the rules that are really there, with ufw (Debian, Ubuntu) and firewalld (Fedora, Rocky, RHEL).

Nothing you type here is sent. Nothing is saved, unless you switch on Remember. Privacy policy

Working over SSH? Allow SSH before you switch a firewall on, or you'll lock yourself out of the machine you're working on. Ubuntu and Debian usually use ufw; Fedora, Rocky and RHEL use firewalld. Both write their rules into nftables underneath.

ufw: getting started

sudo ufw status verbose

Whether it's on, the default policy, and every rule.

sudo ufw allow 22/tcp

Allow SSH. Do this before enabling ufw on a remote machine.

sudo ufw default deny incoming

Block everything coming in that a rule doesn't allow (this is already the default).

sudo ufw enable

Switch the firewall on, now and at every boot.

ufw: rules

sudo ufw allow 8080/tcp

Open a port to everyone.

sudo ufw allow from 192.0.2.0/24 to any port 8080 proto tcp

Open a port to one network only.

sudo ufw insert 1 deny from 192.0.2.10

Block an address. It goes in at the top, because ufw uses the first rule that matches and an allow rule higher up would win.

sudo ufw status numbered

The rules with numbers, for deleting.

sudo ufw delete 3

Delete a rule by its number from the list above.

sudo ufw delete allow 8080/tcp

Delete a rule by writing it out again.

sudo ufw app list

The ready-made profiles installed programs provide (like OpenSSH or Nginx Full), for ufw allow.

firewalld: looking

sudo firewall-cmd --state

Whether firewalld is running.

sudo firewall-cmd --get-active-zones

Which zones are in use, and which interfaces and networks are in each.

sudo firewall-cmd --zone=public --list-all

Everything a zone allows: services, ports and sources.

sudo firewall-cmd --get-services

Every service name firewalld knows (https, ssh, postgresql and so on).

firewalld: rules

sudo firewall-cmd --zone=public --add-service=https

Open a service right now. It's lost at the next reload or reboot, which makes it a safe way to try something.

sudo firewall-cmd --runtime-to-permanent

Happy with how it is? Keep the current rules for good.

sudo firewall-cmd --zone=public --add-port=8080/tcp --permanent

Open a port for good. It takes effect after a reload.

--permanent: save it, but don't apply it until --reload

sudo firewall-cmd --zone=public --remove-service=https --permanent

Close a service for good (after a reload).

sudo firewall-cmd --zone=drop --add-source=192.0.2.10 --permanent

Block an address completely, by sending everything from it to the drop zone.

sudo firewall-cmd --zone=trusted --add-source=192.0.2.0/24 --permanent

Let one network through to everything. Only for networks you really trust.

sudo firewall-cmd --reload

Apply the permanent rules (anything you added without --permanent is dropped).

Underneath

sudo nft list ruleset

Every rule actually loaded, whichever tool put it there. The final word on what's allowed.

sudo iptables -L -n -v --line-numbers

The rules as iptables sees them, with how many packets each has matched. For older systems and Docker.