Firewalling is about filtering incoming network traffic, and firewalling in Linux is implemented by
the Linux kernel, so it's at the deepest level of the operating system.
On Red Hat, Firewall D is used as a standard firewalling solution.
And on Ubuntu it's ufw, the uncomplicated firewall, which is the default firewall.
They are completely different solutions, so let's talk about both of them.
To work with firewalld, start with firewall cmd. That's the main command line interface.
To configure it, list all shows current configuration, and if you want
to allow access to certain applications, you can use Firewall D services.
Firewall cmd get services shows the available services, and Firewall CMD
add service allows you to add a service to the firewall.
Now, while working with firewalld, you need to know that it makes a difference between the runtime and the persistent configuration.
To ensure that configuration modification survives a reboot, you need
to add permanent to add to all the commands.
So firewall cmd add surface HTTP permanent and use
firewall cmd reload to reload the firewall configuration.
Let me show you.
So here we have firewall cmd list all, and that's showing the current configuration.
So I want to enable a service, let's say HTTP,
then I would need sudo firewall cmd get services to
get an overview of these ready to use services.
And somewhere in there there is HTTP. Look, there it is.
So I need firewall cmd add service HTTP
permanent to add it to the persistent configuration.
Now, adding it to the persistent configuration doesn't change the here and now configuration.
But if at this point we use sudo firewall cmd then it has become
active at the moment and you can start using your HTTP servers.
And that's how you can create basic configurations in firewalld.
So on Ubuntu it's a different story. We have ufw, the uncomplicated
firewall, and it was developed to work with an intuitive syntax.
So you use sudo ufw enable to enable it and then sudo ufw
to allow the SSH service, which will check for details about this service.
In the val etc services, you can use sudo ufw redec out ssh
to redact outgoing SSH traffic and sudo ufw status is giving status information.
And if you regret rejecting the outgoing SSH traffic, well, you delete it using delete
reject out ssh sudoufw reset will reset it in case you made a mess.
App list will give you a list of applications and app info will tell you what's going on in an application.
And then we have UFW logging on, which enables logging, which allows you to
figure out what is going on in your firewall. Let's do a quick demo.
So sudo UFW status is showing
me what is giving me inactive.
So if I want to enable it, then enable is what I need.
So now it's active and enabled at startup and status is showing that it is active.
Now I want to use sudo UFW allow SSH and that has
added the rule. Do we see that in UFW status? Yeah, we
can see that. And SSH is now allowed from anywhere.
And if we want to reject the outgoing traffic, reject out ssh.
Oops.
And from now on we have added the rule and you can see that
it is adding instead of the allow the reject out. So incoming SSH is
allowed, outgoing SSH is not. And if you regret, and I would regret it
because this is really inconvenient, just use delete to delete it again.
Oh, I'm making a mistake. It's not delete out, it's delete reject out.
And now the rule has been deleted.
UFW also works with applications.
So UFW app list is showing the applications.
Why would you want to have these applications? Well, because in the applications you can have more complex configuration.
So app info on Cups is showing what is going on. If you are working with
the Cups print server now so far for the complex information, it's not complex at all.
But you can use app add to add a complete application
instead of these service based names that we just started with.