Firewall concepts - what a Linux firewall actually does

Foundation⏱ ~10 minbash

What you'll learn

Describe the netfilter hooks and what each does
Distinguish host firewall from network firewall
Choose between nftables, iptables, firewalld, and ufw
Recognise stateful vs stateless filtering

Prerequisites

Verified against Ubuntu 24.04 LTS · Debian 12 (Bookworm) · RHEL 9.x · Rocky Linux 9.x · AlmaLinux 9.x · Linux kernel 6.1 LTS / 6.6 LTS · systemd 255+ · OpenSSH 8.7p1 (RHEL 9) / 9.6p1 (Ubuntu 24.04) · nftables 1.0.x · chrony 4.x · Pacemaker 2.1.x · Corosync 3.1.x · 2026-08-09

Not yet marked complete on this device.

A Linux firewall is a set of rules applied at well-defined points in the kernel’s network stack. The rules decide whether to accept, drop, or reject packets, and (for stateful firewalls) whether to track them.

The netfilter hooks

Linux networking has five well-defined points where a firewall can intercept packets:

Hook	When
PREROUTING	Before the routing decision (raw, mangle, nat tables)
INPUT	Packets destined for this host (filter, security, mangle)
FORWARD	Packets routed through this host (filter, security, mangle)
OUTPUT	Packets originating from this host (filter, security, mangle, nat, raw)
POSTROUTING	After routing (mangle, nat)

A host that does not route packets only uses INPUT (incoming) and OUTPUT (outgoing). A router uses FORWARD as well.

Host vs network firewall

Type	Scope
Host firewall	Runs on the host itself, protects that host only
Network firewall	Runs on a dedicated device, protects an entire network segment

A Linux host firewall protects the host it runs on. To protect a whole network, you need a dedicated firewall (or a router with firewall rules), which is out of scope for this course.

Stateful vs stateless

Stateless: each packet is judged independently on its source, destination, and protocol. UDP and ICMP can be filtered this way.
Stateful: the firewall tracks connections. A packet matching an existing ESTABLISHED connection is allowed without further rules. This is the standard for TCP.

Stateful filtering requires the conntrack module, which records active connections.

Which tool to use

Tool	When
nftables	Modern default on Debian, Ubuntu, RHEL 9, Rocky, Alma, Fedora
iptables	Legacy; still in older documentation and distros
firewalld	RHEL family default for “zone”-based management
ufw	Ubuntu’s simplified wrapper

For new designs, nftables is the right choice. It combines IPv4 and IPv6 rules, is faster, and is the upstream target for new features.

Read the current rules

sudo iptables -L -n -v              # legacy, but still works
sudo nft list ruleset               # modern
sudo firewall-cmd --list-all        # firewalld
sudo ufw status                     # ufw

For a quick check of what is permitted:

sudo nft list chain inet filter input

Default policy

Every chain has a default policy: ACCEPT (allow everything not explicitly denied) or DROP (deny everything not explicitly allowed). For production, the default should be DROP - allow only what is necessary.

Validate the actual behaviour

Configuration files say what should happen. nft list ruleset says what is configured. Only a live test confirms what actually happens. Use nc -vz, nmap, or external scans to verify the firewall matches the policy.