Firewall Basics for Linux Servers:UFW, firewalld and Cloud Firewalls

A firewall on a Linux server controls which network connections are allowed in and out. On a web server, the safe default is deny all incoming traffic, then allow only what you need: usually SSH (port 22, ideally restricted to trusted addresses), HTTP (80) and HTTPS (443). UFW is the simple front end common on Ubuntu; firewalld is the default on AlmaLinux and Rocky Linux. Both manage the kernel's packet filter (nftables or iptables) underneath.

How a host firewall works

The Linux kernel filters packets using rules. Tools like UFW and firewalld let you write those rules in a friendlier way:

• Default policies decide what happens to traffic that matches no rule (for example deny incoming, allow outgoing).
• Allow rules open specific ports or services, optionally only from specific source addresses.
• Stateful filtering automatically allows replies to connections the server started.

Which ports a typical web server needs

Port	Service	Open to
22	SSH	Ideally only your office/VPN IPs
80	HTTP	Everyone (redirects to HTTPS)
443	HTTPS	Everyone
25, 465, 587	Mail (SMTP)	Only if the server runs a mail server
3306	MySQL/MariaDB	Not public; localhost or private network only
6379	Redis	Not public; localhost only
2083, 2087 etc.	Control panel	As required by the panel, restricted if possible

Anything not on your list should be closed.

UFW (Ubuntu, Debian)

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH                         # or: sudo ufw allow from 203.0.113.5 to any port 22
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

To remove a rule: sudo ufw status numbered, then sudo ufw delete <number>.

firewalld (AlmaLinux, Rocky Linux)

firewalld uses zones; the public interface is usually in the public zone.

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

To allow SSH only from one address, use a rich rule or a dedicated zone with that source.

Avoid locking yourself out

• Allow SSH before enabling the firewall.
• Keep your current SSH session open while testing a new connection in a second terminal.
• Know your provider's console access (web console or rescue mode), which works even if SSH is blocked.
• Be careful when restricting SSH to one IP if your office IP changes.

Cloud and provider firewalls

Many providers offer a network firewall that filters traffic before it reaches your server. It is useful because:

• it blocks unwanted traffic without using your server's resources;
• it still protects the server if the host firewall is misconfigured.

Use it together with the host firewall, with consistent rules.

Docker and firewalls

Docker manipulates firewall rules itself. Ports published with -p can bypass UFW rules and become publicly reachable. Bind container ports to localhost (-p 127.0.0.1:8080:80) unless they must be public, and check what is reachable from outside.

Check what is actually listening

The firewall is only half the picture. List listening services:

sudo ss -tulpn

A service that does not need to be reachable should listen only on 127.0.0.1 in its own configuration, not just be blocked by the firewall.

Worked example: a typical web server rule set

For a VPS running a website, where SSH should only be reachable from the office (203.0.113.5) and a monitoring service needs to ping the server:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 203.0.113.5 to any port 22 proto tcp comment 'SSH from office'
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'
sudo ufw enable

Then check:

sudo ufw status numbered

If you cannot restrict SSH to fixed addresses, use sudo ufw limit 22/tcp instead of an allow rule: it opens SSH to everyone but rate-limits repeated connection attempts. Do not add it alongside an IP-restricted rule, because it would re-open SSH to all addresses. If the office IP changes, add the new address before removing the old rule, from a session you know works.

Logging and reviewing blocked traffic

Turning on logging helps you understand what the firewall blocks:

sudo ufw logging low
sudo journalctl -k | grep UFW | tail

With firewalld, sudo firewall-cmd --set-log-denied=all logs denied packets (use sparingly; it can be noisy). Review logs occasionally for unexpected patterns, such as repeated attempts on database ports, which suggest a service was exposed at some point.

Firewall changes during deployments

• Put firewall rules in your server setup scripts or configuration management, so rebuilding a server reproduces them exactly.
• Document why each port is open.
• Review open ports after installing new software; installers sometimes open their own ports.

Frequently Asked Questions

Do I need a firewall if no services are listening?

Yes. A firewall protects you when a service is installed or misconfigured later, which is when mistakes usually happen.

Does a firewall stop DDoS attacks?

A host firewall cannot stop large attacks, because the traffic still fills the network link. That needs upstream protection. See DDoS attacks explained.

Should I block outgoing traffic too?

For most web servers, allowing outgoing traffic is fine. Restricting outbound traffic is useful for high-security setups but needs careful maintenance.

Related reading

The firewall is step 5 of the Linux server hardening checklist. For the fundamentals, see what is a VPS, and compare the ServerNeed VPS plans.

Sources

• Ubuntu Server documentation: Firewalls
• firewalld documentation

Featured image: “HP EVA 3000 Storage Area Network” by DaveHabben, licensed under CC BY 2.0.