Use UFW for simple firewall setup with commands like sudo ufw allow ssh and sudo ufw enable after setting defaults to deny incoming and allow outgoing traffic. 2. Use iptables for advanced control by setting policies with sudo iptables -P INPUT DROP, allowing loopback and established connections, opening ports for services, and saving rules via sudo iptables-save > /etc/iptables/rules.v4 to persist after reboot. The choice depends on user expertise and requirements, with UFW being beginner-friendly and iptables offering granular control, both effective when configured correctly to secure a Linux system exposed to the internet.

Setting up a firewall on Linux is essential for securing your system, especially if it's exposed to the internet. Two of the most common tools for managing firewalls on Linux are UFW (Uncomplicated Firewall) and iptables. UFW is great for beginners, while iptables offers more granular control. Here’s how to set up a firewall using both.

1. Using UFW (Beginner-Friendly)

UFW is designed to make firewall configuration simple. It’s pre-installed on Ubuntu and can be easily added to other distributions.

Install UFW (if not already installed)

sudo apt update
sudo apt install ufw

Check UFW Status

sudo ufw status verbose

This shows whether the firewall is active and what rules are in place.

Set Default Policies

Start by denying all incoming traffic and allowing outgoing traffic:

sudo ufw default deny incoming
sudo ufw default allow outgoing

Allow Essential Services

Open ports for common services:

sudo ufw allow ssh          # Port 22
sudo ufw allow http         # Port 80
sudo ufw allow https        # Port 443

Or specify ports directly:

sudo ufw allow 22/tcp
sudo ufw allow 8080

Enable the Firewall

sudo ufw enable

You’ll get a warning if SSH is blocked — make sure you’ve allowed SSH first if connecting remotely.

Delete Rules (if needed)

To remove a rule:

sudo ufw delete allow 8080

2. Using iptables (Advanced Control)

iptables is the underlying firewall tool that UFW configures behind the scenes. It gives you full control but requires more precision.

Check Current iptables Rules

sudo iptables -L -n -v

• -L: List rules
• -n: Show IP addresses (not resolved to names)
• -v: Verbose output

Flush Existing Rules (Start Fresh)

?? Be careful — this removes all rules:

sudo iptables -F

Set Default Policies

sudo iptables -P INPUT DROP     # Deny all incoming
sudo iptables -P FORWARD DROP   # Block forwarding
sudo iptables -P OUTPUT ACCEPT  # Allow all outgoing

Allow Loopback Traffic

Local services need the loopback interface:

sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

Allow Established Connections

So responses to your outgoing requests aren’t blocked:

sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Open Specific Ports

Allow SSH, HTTP, and HTTPS:

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Save iptables Rules

Rules are lost on reboot unless saved. On Ubuntu/Debian:

sudo iptables-save > /etc/iptables/rules.v4

On some systems, use:

sudo netfilter-persistent save

? Tip: Use a tool like iptables-persistent to auto-restore rules at boot.

UFW vs iptables: When to Use Which?

You can even use UFW with custom iptables rules — UFW allows inserting raw iptables rules via config files.

Final Tips

• Always allow SSH before enabling the firewall remotely.
• Test rules from another machine to avoid lockout.
• Use sudo ufw deny or iptables DROP carefully — mistakes can block access.
• Keep a backup rule set or use fail-safe scripts during testing.

Basically, go with UFW for simplicity, and iptables when you need full control. Both get the job done — just pick the right tool for your comfort level and needs.

The above is the detailed content of How to Set Up a Firewall on Linux with UFW and iptables. For more information, please follow other related articles on the PHP Chinese website!