LFCA 49 🐧 Basic Firewall Commands — ufw, firewalld - KandZ

The previous chapter covered the firewall’s concepts: the netfilter’s hooks, the tables, the chains, the connection’s tracking, and the default’s policy. This chapter covers the two front-ends that make the firewall’s configuration practical: ufw and firewalld. The two are the wrappers around the kernel’s netfilter, and each simplifies the rule’s management. The ufw is the Debian and the Ubuntu’s default, and it is the simpler’s interface. The firewalld is the RHEL and the Fedora’s default, and it is the zone-based’s. The two are the different, and the choice depends on the distribution and the workflow. This chapter covers the two tools’ installation, the basic’s commands, the rule’s addition and removal, the default’s policies, the application’s profiles, the zones, the reload, and the diagnosis. It builds on LFCA 48 and prepares the ground for the more advanced’s firewall’s material.

Key point: The ufw is the Debian-based’s, and the firewall-cmd is the Red Hat-based’s. The ufw‘s commands are the simple’s — the allow, the deny, the enable, the disable, the status — and the firewall-cmd‘s are the zone-based’s — the --add-port, the --remove-port, the --reload, the --list-ports. The two are the front’s, and the kernel’s netfilter is the back’s. The ufw uses the iptables’ or the nftables’ backend, and the firewalld uses the nftables’ or the iptables’. The default’s policy is the deny‘s incoming and the allow‘s outgoing, and the SSH’s rule is the first’s. The ufw allow opens the port, and the firewall-cmd --add-port --permanent opens the port. The ufw enable activates the firewall, and the firewall-cmd --reload applies the permanent’s rules. The lockout’s risk is the discipline’s.

The ufw — the uncomplicated firewall

The ufw is the uncomplicated’s firewall, and it is the Debian and the Ubuntu’s default. It is the front’s, and it simplifies the iptables’ and the nftables’ syntax.

The installation. The ufw is the apt install ufw‘s, and the installation is the simple’s.

sudo apt install ufw

The sudo apt install ufw is the installation’s, and the installation’s is the Debian’s. The two are the pair, and the pair is the install’s.

Why the ufw’s installation matters. The ufw’s installation is the Debian’s, and the Debian’s is the default’s. The apt is the package’s, and the package’s is the install’s. The two are the pair, and the pair is the modern’s.

The status’s check. The sudo ufw status is the status’s, and the status’s is the inactive’s.

sudo ufw status
# Status: inactive

The Status: inactive is the default’s, and the default’s is the disabled’s. The ufw is the disabled’s by default, and the disabled is the safety’s.

Why the ufw’s status matters. The ufw’s status is the default’s, and the default’s is the disabled’s. The Status: inactive is the sign’s, and the sign’s is the configuration’s. The two are the pair, and the pair is the pattern’s.

The default’s policies. The sudo ufw default deny incoming and the sudo ufw default allow outgoing are the defaults’s.

sudo ufw default deny incoming
sudo ufw default allow outgoing

The deny incoming is the incoming’s, and the allow outgoing is the outgoing’s. The two are the pair, and the pair is the default’s.

Why the defaults matter. The defaults are the policy’s, and the policy’s is the baseline’s. The deny incoming is the secure’s, and the secure’s is the recommended’s. The two are the pair, and the pair is the design’s.

The SSH’s rule. The sudo ufw allow ssh is the SSH’s, and the SSH’s is the first’s.

sudo ufw allow ssh
# Rules updated
# Rules updated (v6)

The sudo ufw allow ssh is the SSH’s, and the SSH’s is the first’s. The Rules updated is the confirmation’s, and the confirmation’s is the safety’s.

Why the SSH’s rule matters. The SSH’s rule is the first’s, and the first’s is the lockout’s. The allow ssh is the prevention’s, and the prevention’s is the discipline’s. The two are the pair, and the pair is the safety’s.

The other’s rules. The sudo ufw allow http and the sudo ufw allow https are the web’s.

sudo ufw allow http
sudo ufw allow https

The allow http is the 80’s, and the allow https is the 443’s. The two are the pair, and the pair is the web’s.

Why the other’s rules matter. The other’s rules are the web’s, and the web’s is the common’s. The http and the https are the services’, and the services’ are the names’. The two are the pair, and the pair is the readable’s.

The port’s rule. The sudo ufw allow 8080/tcp is the port’s, and the port’s is the specific’s.

sudo ufw allow 8080/tcp

The sudo ufw allow 8080/tcp is the port’s, and the port’s is the specific’s. The 8080 is the number’s, and the tcp is the protocol’s. The two are the pair, and the pair is the specific’s.

Why the port’s rule matters. The port’s rule is the specific’s, and the specific’s is the application’s. The 8080 is the Tomcat’s, and the Tomcat’s is the example’s. The two are the pair, and the pair is the pattern’s.

The IP’s rule. The sudo ufw allow from 192.168.1.0/24 is the IP’s, and the IP’s is the subnet’s.

sudo ufw allow from 192.168.1.0/24

The sudo ufw allow from 192.168.1.0/24 is the IP’s, and the IP’s is the subnet’s. The 192.168.1.0/24 is the network’s, and the network’s is the internal’s. The two are the pair, and the pair is the trust’s.

Why the IP’s rule matters. The IP’s rule is the trust’s, and the trust’s is the boundary’s. The from is the source’s, and the source’s is the restriction’s. The two are the pair, and the pair is the security’s.

The deny’s rule. The sudo ufw deny from 10.0.0.5 is the deny’s, and the deny’s is the block’s.

sudo ufw deny from 10.0.0.5

The sudo ufw deny from 10.0.0.5 is the deny’s, and the deny’s is the block’s. The 10.0.0.5 is the specific’s, and the specific’s is the blocked’s. The two are the pair, and the pair is the security’s.

Why the deny’s rule matters. The deny’s rule is the block’s, and the block’s is the specific’s. The deny is the explicit’s, and the explicit’s is the override’s. The two are the pair, and the pair is the security’s.

The enable’s command. The sudo ufw enable is the enable’s, and the enable’s is the activation’s.

sudo ufw enable
# Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
# Firewall is active and enabled on system startup

The sudo ufw enable is the enable’s, and the enable’s is the activation’s. The Command may disrupt existing ssh connections is the warning’s, and the warning’s is the SSH’s. The two are the pair, and the pair is the safety’s.

Why the enable’s command matters. The enable’s command is the activation’s, and the activation’s is the firewall’s. The Proceed with operation (y|n)? is the confirmation’s, and the confirmation’s is the user’s. The two are the pair, and the pair is the discipline’s.

The delete’s command. The sudo ufw delete 3 is the delete’s, and the delete’s is the number’s.

sudo ufw status numbered
# [ 1] 22/tcp                     ALLOW IN    Anywhere
# [ 2] 80/tcp                     ALLOW IN    Anywhere
# [ 3] 443/tcp                    ALLOW IN    Anywhere

sudo ufw delete 3

The sudo ufw delete 3 is the delete’s, and the delete’s is the number’s. The [ 3] 443/tcp is the third’s, and the third’s is the HTTPS’s. The two are the pair, and the pair is the pattern’s.

Why the delete’s command matters. The delete’s command is the number’s, and the number’s is the specific’s. The status numbered is the list’s, and the list’s is the reference’s. The two are the pair, and the pair is the pattern’s.

The app’s profiles. The sudo ufw app list is the profiles’s, and the profiles’s is the application’s.

sudo ufw app list
# Available applications:
#   OpenSSH
#   Apache
#   Nginx Full

The sudo ufw app list is the profiles’s, and the profiles’s is the application’s. The OpenSSH, the Apache, the Nginx Full are the profiles’s, and the profiles’s is the bundle’s. The two are the pair, and the pair is the convenience’s.

Why the app’s profiles matter. The app’s profiles are the bundle’s, and the bundle’s is the multiple’s ports. The Apache Full is the 80’s and the 443’s, and the two are the bundle’s. The two are the pair, and the pair is the readable’s.

The reload’s command. The sudo ufw reload is the reload’s, and the reload’s is the apply’s.

sudo ufw reload
# Firewall reloaded

The sudo ufw reload is the reload’s, and the reload’s is the apply’s. The Firewall reloaded is the confirmation’s, and the confirmation’s is the success’s. The two are the pair, and the pair is the pattern’s.

Why the reload’s command matters. The reload’s command is the apply’s, and the apply’s is the configuration’s. The ufw applies the rules immediately, and the immediately is the convenience’s. The two are the pair, and the pair is the modern’s.

The firewalld

The firewalld is the Red Hat’s, and it is the zone-based’s. The CentOS, the RHEL, the Fedora, the AlmaLinux, the Rocky Linux are the firewalld’s, and the firewalld’s is the default’s.

The installation. The firewalld is the dnf install firewalld‘s, and the installation is the Red Hat’s.

sudo dnf install firewalld
sudo systemctl enable firewalld --now

The sudo dnf install firewalld is the installation’s, and the installation’s is the Red Hat’s. The systemctl enable firewalld --now is the start’s, and the start’s is the enable’s. The two are the pair, and the pair is the pattern’s.

Why the firewalld’s installation matters. The firewalld’s installation is the Red Hat’s, and the Red Hat’s is the default’s. The dnf is the package’s, and the package’s is the install’s. The two are the pair, and the pair is the modern’s.

The status’s check. The sudo systemctl status firewalld is the status’s, and the status’s is the running’s.

sudo systemctl status firewalld
# ● firewalld.service - firewalld - dynamic firewall daemon
#      Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)
#      Active: active (running) since ...

The Active: active (running) is the running’s, and the running’s is the service’s. The systemctl is the service’s, and the service’s is the systemd’s. The two are the pair, and the pair is the modern’s.

Why the status’s check matters. The status’s check is the running’s, and the running’s is the diagnosis’s. The systemctl status firewalld is the check’s, and the check’s is the first’s. The two are the pair, and the pair is the pattern’s.

The port’s rule. The sudo firewall-cmd --permanent --add-port=8080/tcp is the port’s, and the port’s is the permanent’s.

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload

The sudo firewall-cmd --permanent --add-port=8080/tcp is the port’s, and the port’s is the permanent’s. The --reload is the apply’s, and the apply’s is the permanent’s. The two are the pair, and the pair is the pattern’s.

Why the port’s rule matters. The port’s rule is the permanent’s, and the permanent’s is the reboot’s. The --permanent is the persistence’s, and the persistence’s is the requirement’s. The two are the pair, and the pair is the design’s.

Why the reload matters. The reload is the apply’s, and the apply’s is the permanent’s. The --reload is the requirement’s, and the requirement’s is the permanent’s. The two are the pair, and the pair is the pattern’s.

The service’s rule. The sudo firewall-cmd --add-service=http --permanent is the service’s, and the service’s is the name’s.

sudo firewall-cmd --add-service=http --permanent
sudo firewall-cmd --add-service=https --permanent
sudo firewall-cmd --reload

The sudo firewall-cmd --add-service=http --permanent is the service’s, and the service’s is the name’s. The http is the 80’s, and the 80’s is the service’s. The two are the pair, and the pair is the readable’s.

Why the service’s rule matters. The service’s rule is the name’s, and the name’s is the readable’s. The http is the service’s, and the service’s is the bundle’s. The two are the pair, and the pair is the convenience’s.

The IP’s rule. The sudo firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16 is the IP’s, and the IP’s is the source’s.

sudo firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16
sudo firewall-cmd --reload

The sudo firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16 is the IP’s, and the IP’s is the source’s. The trusted is the zone’s, and the zone’s is the trust’s. The two are the pair, and the pair is the trust’s.

Why the IP’s rule matters. The IP’s rule is the source’s, and the source’s is the trust’s. The trusted is the zone’s, and the zone’s is the boundary’s. The two are the pair, and the pair is the security’s.

The rich’s rule. The sudo firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='192.168.1.100' port protocol='tcp' port='22' accept" is the rich’s, and the rich’s is the specific’s.

sudo firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='192.168.1.100' port protocol='tcp' port='22' accept"
sudo firewall-cmd --reload

The sudo firewall-cmd --permanent --add-rich-rule is the rich’s, and the rich’s is the specific’s. The source address='192.168.1.100' is the IP’s, and the IP’s is the SSH’s. The two are the pair, and the pair is the security’s.

Why the rich’s rule matters. The rich’s rule is the specific’s, and the specific’s is the IP’s. The source address is the restriction’s, and the restriction’s is the SSH’s. The two are the pair, and the pair is the security’s.

The list’s command. The sudo firewall-cmd --list-ports is the list’s, and the list’s is the ports’s.

sudo firewall-cmd --list-ports
# 80/tcp 8080/tcp 3306/tcp

The sudo firewall-cmd --list-ports is the list’s, and the list’s is the ports’s. The 80/tcp, the 8080/tcp, the 3306/tcp are the ports’s, and the ports’s is the list’s. The two are the pair, and the pair is the audit’s.

Why the list’s command matters. The list’s command is the audit’s, and the audit’s is the review’s. The --list-ports is the list’s, and the list’s is the diagnosis’s. The two are the pair, and the pair is the pattern’s.

The zone’s concept. The zone is the firewalld’s, and the zone’s is the trust’s. The public, the trusted, the home, the work, the dmz, the drop, the block are the zones’s.

sudo firewall-cmd --get-active-zones
# public
#   interfaces: eth0

The sudo firewall-cmd --get-active-zones is the zone’s, and the zone’s is the active’s. The public is the default’s, and the default’s is the common’s. The two are the pair, and the pair is the model’s.

Why the zone’s concept matters. The zone’s concept is the trust’s, and the trust’s is the boundary’s. The public is the untrusted’s, and the trusted is the trusted’s. The two are the pair, and the pair is the design’s.

The zone’s assignment. The sudo firewall-cmd --zone=public --change-interface=eth0 is the zone’s, and the zone’s is the assignment’s.

sudo firewall-cmd --zone=public --change-interface=eth0 --permanent
sudo firewall-cmd --reload

The sudo firewall-cmd --zone=public --change-interface=eth0 --permanent is the zone’s, and the zone’s is the assignment’s. The eth0 is the interface’s, and the interface’s is the zone’s. The two are the pair, and the pair is the model’s.

Why the zone’s assignment matters. The zone’s assignment is the interface’s, and the interface’s is the trust’s. The public is the zone’s, and the zone’s is the boundary’s. The two are the pair, and the pair is the design’s.

The two tools’ comparison

The two tools are the front’s, and the two are the different’s. The ufw is the simple’s, and the firewalld is the zone-based’s. The two are the choice’s, and the choice is the distribution’s.

The ufw’s syntax. The ufw’s syntax is the allow‘s, the deny‘s, the enable‘s, the status‘s. The four are the simple’s, and the simple’s is the readable’s.

Why the ufw’s syntax matters. The ufw’s syntax is the simple’s, and the simple’s is the beginner’s. The allow is the intuitive’s, and the intuitive’s is the fast’s. The two are the pair, and the pair is the ergonomics’s.

The firewalld’s syntax. The firewalld’s syntax is the --add-port‘s, the --remove-port‘s, the --reload‘s, the --list-ports‘s. The four are the explicit’s, and the explicit’s is the specific’s.

Why the firewalld’s syntax matters. The firewalld’s syntax is the explicit’s, and the explicit’s is the zone’s. The --zone is the model’s, and the model’s is the trust’s. The two are the pair, and the pair is the design’s.

The distribution’s default. The ufw is the Debian’s and the Ubuntu’s, and the firewalld is the Red Hat’s and the Fedora’s. The two are the default’s, and the default’s is the distribution’s.

Why the distribution’s default matters. The distribution’s default is the choice’s, and the choice’s is the convenient’s. The apt is the Debian’s, and the dnf is the Red Hat’s. The two are the pair, and the pair is the package’s.

The zone’s model. The firewalld’s zone’s model is the trust’s, and the trust’s is the boundary’s. The public is the untrusted’s, and the trusted is the trusted’s. The two are the pair, and the pair is the design’s.

Why the zone’s model matters. The zone’s model is the firewalld’s, and the firewalld’s is the specific’s. The ufw’s is the flat’s, and the flat’s is the simple’s. The two are the different’s, and the different is the choice’s.

The reload’s requirement. The firewalld’s --reload is the requirement’s, and the requirement’s is the permanent’s. The ufw’s is the immediate’s, and the immediate’s is the convenience’s.

Why the reload’s requirement matters. The reload’s requirement is the firewalld’s, and the firewalld’s is the pattern’s. The --permanent is the persistence’s, and the persistence’s is the reboot’s. The two are the pair, and the pair is the design’s.

The lockout’s risk. The lockout’s risk is the two’s, and the two’s is the SSH’s. The allow ssh is the prevention’s, and the prevention’s is the first’s. The two are the pair, and the pair is the discipline’s.

Why the lockout’s risk matters. The lockout’s risk is the discipline’s, and the discipline’s is the safety’s. The SSH’s rule is the first’s, and the first’s is the prevention’s. The two are the pair, and the pair is the pattern’s.

The diagnosis

The diagnosis is the two tools’ status, the ports’ list, the rules’ review, and the test. The four are the common, and the common is the diagnosis’s.

The status’s check. The sudo ufw status verbose is the ufw’s, and the sudo firewall-cmd --list-all is the firewalld’s.

sudo ufw status verbose
sudo firewall-cmd --list-all

The sudo ufw status verbose is the ufw’s, and the ufw’s is the detailed’s. The sudo firewall-cmd --list-all is the firewalld’s, and the firewalld’s is the complete’s. The two are the pair, and the pair is the diagnosis’s.

Why the status’s check matters. The status’s check is the diagnosis’s, and the diagnosis’s is the first’s. The verbose is the detailed’s, and the detailed’s is the policy’s. The two are the pair, and the pair is the pattern’s.

The ports’ list. The sudo firewall-cmd --list-ports is the firewalld’s, and the sudo ufw status numbered is the ufw’s.

sudo firewall-cmd --list-ports
sudo ufw status numbered

The sudo firewall-cmd --list-ports is the firewalld’s, and the firewalld’s is the ports’s. The sudo ufw status numbered is the ufw’s, and the ufw’s is the rules’s. The two are the pair, and the pair is the audit’s.

Why the ports’ list matters. The ports’ list is the audit’s, and the audit’s is the review’s. The --list-ports is the list’s, and the list’s is the diagnosis’s. The two are the pair, and the pair is the pattern’s.

The rules’ review. The sudo iptables -L -n -v is the kernel’s, and the kernel’s is the underlying’s.

sudo iptables -L -n -v

The sudo iptables -L -n -v is the kernel’s, and the kernel’s is the underlying’s. The ufw and the firewalld are the front’s, and the front’s is the wrapper’s. The two are the pair, and the pair is the diagnosis’s.

Why the rules’ review matters. The rules’ review is the underlying’s, and the underlying’s is the verification’s. The front’s is the wrapper’s, and the wrapper’s is the convenience’s. The two are the pair, and the pair is the diagnosis’s.

The test. The nmap -p 80 localhost is the test’s, and the test’s is the verification’s.

sudo nmap -p 80 localhost
# PORT   STATE SERVICE
# 80/tcp open  http

The sudo nmap -p 80 localhost is the test’s, and the test’s is the verification’s. The open is the confirmation’s, and the confirmation’s is the success’s. The two are the pair, and the pair is the diagnosis’s.

Why the test matters. The test is the verification’s, and the verification’s is the safety’s. The open is the confirmation’s, and the confirmation’s is the success’s. The two are the pair, and the pair is the pattern’s.

The lockout’s recovery. The console’s is the recovery’s, and the recovery’s is the rescue’s. The ufw disable is the recovery’s, and the firewall-cmd --panic-off is the recovery’s.

# From the console:
sudo ufw disable
# or
sudo firewall-cmd --panic-off

The sudo ufw disable is the ufw’s, and the ufw’s is the recovery’s. The sudo firewall-cmd --panic-off is the firewalld’s, and the firewalld’s is the recovery’s. The two are the pair, and the pair is the rescue’s.

Why the lockout’s recovery matters. The lockout’s recovery is the console’s, and the console’s is the rescue’s. The disable is the recovery’s, and the recovery’s is the last’s. The two are the pair, and the pair is the discipline’s.

Complete Example Session

# ============================================
# PART 1: THE UFW'S INSTALLATION AND STATUS
# ============================================

sudo apt install ufw
sudo ufw status
# Status: inactive

# ============================================
# PART 2: THE UFW'S DEFAULTS
# ============================================

sudo ufw default deny incoming
sudo ufw default allow outgoing

# ============================================
# PART 3: THE UFW'S SSH'S RULE
# ============================================

sudo ufw allow ssh
# Rules updated
# Rules updated (v6)

# ============================================
# PART 4: THE UFW'S OTHER'S RULES
# ============================================

sudo ufw allow http
sudo ufw allow https
sudo ufw allow 8080/tcp
sudo ufw allow from 192.168.1.0/24

# ============================================
# PART 5: THE UFW'S ENABLE
# ============================================

sudo ufw enable
# Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
# Firewall is active and enabled on system startup

# ============================================
# PART 6: THE UFW'S STATUS AND DELETE
# ============================================

sudo ufw status numbered
# [ 1] 22/tcp                     ALLOW IN    Anywhere
# [ 2] 80/tcp                     ALLOW IN    Anywhere
# [ 3] 443/tcp                    ALLOW IN    Anywhere

sudo ufw delete 3

# ============================================
# PART 7: THE FIREWALLD'S STATUS
# ============================================

sudo systemctl status firewalld
# ● firewalld.service - firewalld - dynamic firewall daemon
#      Active: active (running)

# ============================================
# PART 8: THE FIREWALLD'S PORT'S RULE
# ============================================

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-ports
# 8080/tcp

# ============================================
# PART 9: THE FIREWALLD'S SERVICE'S RULE
# ============================================

sudo firewall-cmd --add-service=http --permanent
sudo firewall-cmd --add-service=https --permanent
sudo firewall-cmd --reload
sudo firewall-cmd --list-services
# http https

# ============================================
# PART 10: THE FIREWALLD'S RICH'S RULE
# ============================================

sudo firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='192.168.1.100' port protocol='tcp' port='22' accept"
sudo firewall-cmd --reload

# ============================================
# PART 11: THE DIAGNOSIS
# ============================================

sudo ufw status verbose
sudo firewall-cmd --list-all
sudo iptables -L -n -v
sudo nmap -p 80 localhost

# ============================================
# PART 12: WHAT NOT TO DO
# ============================================

# Don't enable the firewall without the SSH's rule
sudo ufw enable  # the lockout's risk                         // ⚠️

# Don't forget the --permanent on the firewalld
sudo firewall-cmd --add-port=8080/tcp  # the reboot's loss    // ⚠️

# Don't forget the --reload on the firewalld
# The permanent's rules are not applied.                     // ⚠️

# Don't use the ufw and the firewalld together
# The two's conflict.                                        // ⚠️

# Don't forget the zone on the firewalld
# The default's zone is the public.                          // ⚠️

# Don't forget the test
# The lockout's risk.                                        // ⚠️

The twelve parts cover the ufw’s installation and status, the ufw’s defaults, the ufw’s SSH’s rule, the ufw’s other’s rules, the ufw’s enable, the ufw’s status and delete, the firewalld’s status, the firewalld’s port’s rule, the firewalld’s service’s rule, the firewalld’s rich’s rule, the diagnosis, and the anti-patterns.

Quick Reference

The ufw’s Commands

The command	The purpose
The `ufw enable`	The activation
The `ufw disable`	The deactivation
The `ufw status`	The status
The `ufw status verbose`	The detailed’s
The `ufw status numbered`	The numbered’s
The `ufw allow <port>`	The allow’s
The `ufw deny <port>`	The deny’s
The `ufw allow from <ip>`	The IP’s
The `ufw delete <n>`	The delete’s
The `ufw default deny incoming`	The default’s
The `ufw reload`	The reload’s
The `ufw app list`	The profiles’s

The firewalld’s Commands

The command	The purpose
The `firewall-cmd --state`	The status
The `firewall-cmd --add-port=<p>/<t>`	The port’s
The `firewall-cmd --remove-port=<p>/<t>`	The remove’s
The `firewall-cmd --add-service=<s>`	The service’s
The `firewall-cmd --list-ports`	The ports’s
The `firewall-cmd --list-all`	The complete’s
The `firewall-cmd --reload`	The reload’s
The `firewall-cmd --permanent`	The persistence’s
The `firewall-cmd --add-rich-rule`	The rich’s
The `firewall-cmd --get-active-zones`	The zone’s

The ufw’s vs the firewalld’s

The aspect	The ufw	The firewalld
The distribution	The Debian, the Ubuntu	The RHEL, the Fedora
The model	The flat	The zone’s
The syntax	The `allow`, the `deny`	The `--add-port`, the `--add-service`
The reload	The immediate	The `--reload`
The service	The `app`	The `--add-service`
The IP	The `from`	The `--add-source`, the rich’s

The Lockout’s Prevention

The step	The command
1. The SSH’s rule	The `ufw allow ssh` or the `firewall-cmd --add-service=ssh`
2. The enable	The `ufw enable` or the `firewall-cmd --reload`
3. The console’s access	The recovery’s

The Diagnosis’s Commands

The command	The purpose
The `ufw status verbose`	The ufw’s
The `firewall-cmd --list-all`	The firewalld’s
The `iptables -L -n -v`	The kernel’s
The `nmap -p <port> localhost`	The test’s

Best Practices

✅ Do This:

# Allow the SSH before the enable
sudo ufw allow ssh && sudo ufw enable                          # ✅

# Set the default's policy
sudo ufw default deny incoming && sudo ufw default allow outgoing # ✅

# Use the --permanent on the firewalld
sudo firewall-cmd --permanent --add-port=8080/tcp              # ✅

# Reload the firewalld
sudo firewall-cmd --reload                                     # ✅

# Use the service's names
sudo ufw allow http && sudo ufw allow https                    # ✅

# Use the rich's rule for the IP's restriction
sudo firewall-cmd --permanent --add-rich-rule="rule ..."       # ✅

# Test the rules
sudo nmap -p 80 localhost                                      # ✅

# Document the rules
# The review's and the audit's.                              # ✅

❌ Don’t Do This:

# Don't enable without the SSH's rule
sudo ufw enable  # the lockout's risk                          // ⚠️

# Don't forget the --permanent on the firewalld
sudo firewall-cmd --add-port=8080/tcp  # the reboot's loss     // ⚠️

# Don't forget the --reload on the firewalld
# The permanent's rules are not applied.                     // ⚠️

# Don't use the ufw and the firewalld together
# The two's conflict.                                        // ⚠️

# Don't forget the zone on the firewalld
# The default's zone is the public.                          // ⚠️

# Don't forget the test
# The lockout's risk.                                        // ⚠️

Common Pitfalls

Pitfall	Problem	Solution
The enable without the SSH	The lockout	The `allow ssh` first
The missing `--permanent`	The reboot’s loss	The `--permanent`
The missing `--reload`	The not applied	The `--reload`
The mixed tools	The conflict	The one tool
The missing zone	The wrong zone	The `--zone`
The no test	The lockout	The test
The wrong syntax	The error	The tool’s syntax
The no document	The audit’s	The record

Real-World Examples

1. The ufw’s basic

sudo ufw default deny incoming && sudo ufw default allow outgoing
sudo ufw allow ssh && sudo ufw enable

2. The ufw’s web

sudo ufw allow http && sudo ufw allow https

3. The ufw’s port

sudo ufw allow 8080/tcp

4. The ufw’s IP

sudo ufw allow from 192.168.1.0/24

5. The ufw’s delete

sudo ufw status numbered && sudo ufw delete 3

6. The firewalld’s status

sudo systemctl status firewalld

7. The firewalld’s port

sudo firewall-cmd --permanent --add-port=8080/tcp && sudo firewall-cmd --reload

8. The firewalld’s service

sudo firewall-cmd --add-service=http --permanent && sudo firewall-cmd --reload

9. The firewalld’s rich’s rule

sudo firewall-cmd --permanent --add-rich-rule="rule ..."

10. The diagnosis

sudo ufw status verbose
sudo firewall-cmd --list-all
sudo iptables -L -n -v
sudo nmap -p 80 localhost

Visual: The ufw’s Flow

┌──────────────────────────────────────────────────────────┐
│  THE ufw'S FLOW                                          │
│                                                          │
│  1. sudo apt install ufw                                 │
│  2. sudo ufw default deny incoming                       │
│  3. sudo ufw default allow outgoing                      │
│  4. sudo ufw allow ssh   ← the lockout's prevention      │
│  5. sudo ufw allow http                                  │
│  6. sudo ufw allow https                                 │
│  7. sudo ufw enable                                      │
│  8. sudo ufw status numbered                             │
│                                                          │
│  The ufw's is the simple's, and the simple's is the      │
│  readable's.                                             │
│                                                          │
└──────────────────────────────────────────────────────────┘

Visual: The firewalld’s Flow

┌──────────────────────────────────────────────────────────┐
│  THE firewalld'S FLOW                                    │
│                                                          │
│  1. sudo dnf install firewalld                           │
│  2. sudo systemctl enable firewalld --now                │
│  3. sudo firewall-cmd --add-service=ssh --permanent      │
│  4. sudo firewall-cmd --add-service=http --permanent     │
│  5. sudo firewall-cmd --add-service=https --permanent    │
│  6. sudo firewall-cmd --reload                           │
│  7. sudo firewall-cmd --list-all                         │
│                                                          │
│  The firewalld's is the zone-based's, and the zone's is  │
│  the trust's.                                            │
│                                                          │
└──────────────────────────────────────────────────────────┘

Visual: The Two Tools’ Comparison

┌──────────────────────────────────────────────────────────┐
│  THE ufw                                                 │
│    The Debian, the Ubuntu                                │
│    The flat's model                                      │
│    The allow, the deny                                   │
│    The immediate's                                       │
│    The simple's                                          │
│                                                          │
├──────────────────────────────────────────────────────────┤
│  THE firewalld                                           │
│    The RHEL, the Fedora                                  │
│    The zone's model                                      │
│    The --add-port, the --add-service                     │
│    The --reload's                                        │
│    The zone-based's                                      │
│                                                          │
│  The two are the front's, and the kernel's is the back's.│
│                                                          │
└──────────────────────────────────────────────────────────┘

Visual: The Lockout’s Prevention

┌──────────────────────────────────────────────────────────┐
│  THE LOCKOUT'S RISK                                      │
│                                                          │
│  sudo ufw enable                                         │
│    The SSH's rule is the missing?                        │
│      └── The lockout.                                    │
│                                                          │
│  THE PREVENTION                                          │
│    sudo ufw allow ssh   ← the first's                    │
│    sudo ufw enable      ← the second's                   │
│                                                          │
│  THE RECOVERY                                            │
│    The console's access                                  │
│    sudo ufw disable                                      │
│                                                          │
│  The SSH's rule is the discipline's.                     │
│                                                          │
└──────────────────────────────────────────────────────────┘

Visual: The Zone’s Model

┌──────────────────────────────────────────────────────────┐
│  THE ZONES                                               │
│    public   → the untrusted's (the default)              │
│    trusted  → the trusted's                              │
│    home     → the home's                                 │
│    work     → the work's                                 │
│    dmz      → the dmz's                                  │
│    drop     → the drop's                                 │
│    block    → the block's                                │
│                                                          │
│  THE ASSIGNMENT                                          │
│    The interface → the zone.                             │
│                                                          │
│  The zone's is the trust's, and the trust's is the       │
│  boundary's.                                             │
│                                                          │
└──────────────────────────────────────────────────────────┘

Summary

Item	Value
The ufw	The Debian’s and the Ubuntu’s
The firewalld	The Red Hat’s and the Fedora’s
The ufw’s allow	The `ufw allow <port>`
The ufw’s deny	The `ufw deny <port>`
The ufw’s enable	The `ufw enable`
The ufw’s default	The `ufw default deny incoming`
The firewalld’s add-port	The `firewall-cmd --add-port`
The firewalld’s reload	The `firewall-cmd --reload`
The firewalld’s permanent	The `--permanent`
The lockout’s prevention	The SSH’s rule first

Key takeaways:

The ufw is the Debian’s and the Ubuntu’s, and the firewalld is the Red Hat’s and the Fedora’s — the two are the front’s, and the kernel’s netfilter is the back’s
The ufw’s commands are the simple’s — the allow, the deny, the enable, the status
The firewalld’s commands are the zone-based’s — the --add-port, the --add-service, the --reload, the --list-ports
The default’s policy is the deny‘s incoming and the allow‘s outgoing — the ufw default deny incoming is the secure’s
The SSH’s rule is the first’s — the ufw allow ssh and the firewall-cmd --add-service=ssh are the lockout’s prevention’s
The --permanent is the firewalld’s persistence’s — the rule is the reboot’s, and the --reload is the apply’s
The ufw applies the rules immediately — the firewalld needs the --reload
The zone is the firewalld’s trust’s model — the public is the default’s, and the trusted is the trusted’s
The lockout’s prevention is the SSH’s rule — the allow ssh is the first’s, and the console’s is the recovery’s
The diagnosis is the status’s, the list’s, the rules’s review, and the test’s — the ufw status verbose, the firewall-cmd --list-all, the iptables -L -n -v, and the nmap

Remember: The ufw and the firewalld are the two front’s, and the two are the distribution’s. The ufw is the simple’s, and the firewalld is the zone-based’s. The SSH’s rule is the first’s, and the enable is the second’s. The --permanent is the firewalld’s, and the --reload is the apply’s. The lockout’s risk is the discipline’s, and the test is the safety’s. The firewall’s commands are the security’s, and the security’s is the discipline.

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!