UFW / iptables Firewall Setup
UFW and iptables firewall configuration
A firewall closes off everything that has no business being reachable from outside. Basic server hygiene: only the required ports stay open, everything else does not answer at all.
What is included
- default policy: deny all inbound, allow what is needed;
- rules for the web server, SSH and the services actually in use;
- restricting database and cache access to the local interface;
- administrative port access from specific addresses, where a static IP exists;
- brute-force protection at firewall level;
- persisting rules across reboots — without which everything resets.
The main caveat
It is easy to lock yourself out with a firewall. The most common accident: a rule is applied, SSH is closed, and the server is no longer reachable. So configuration is always done with a fallback route available, and new rules are verified in a separate session before the old one is closed.
Typical findings
A database reachable from the internet. Redis listening on all interfaces without a password. A hosting control panel open to the world. Service ports the owner knew nothing about, opened by some installer.
A firewall does not replace updates and decent passwords — it only reduces the attack surface.
