UFW / iptables Firewall Setup

UFW and iptables firewall configuration

A firewall closes off everything that has no business being reachable from outside. Basic server hygiene: only the required ports stay open, everything else does not answer at all.

What is included

• default policy: deny all inbound, allow what is needed;
• rules for the web server, SSH and the services actually in use;
• restricting database and cache access to the local interface;
• administrative port access from specific addresses, where a static IP exists;
• brute-force protection at firewall level;
• persisting rules across reboots — without which everything resets.

The main caveat

It is easy to lock yourself out with a firewall. The most common accident: a rule is applied, SSH is closed, and the server is no longer reachable. So configuration is always done with a fallback route available, and new rules are verified in a separate session before the old one is closed.

Typical findings

A database reachable from the internet. Redis listening on all interfaces without a password. A hosting control panel open to the world. Service ports the owner knew nothing about, opened by some installer.

A firewall does not replace updates and decent passwords — it only reduces the attack surface.