GUIDESecurity

Server Firewall Hardening Guide

4 min read

A properly configured firewall is one of the most important defenses for your server. It controls which network traffic is allowed in and out, blocking unauthorized access while permitting legitimate services. This guide covers firewall configuration on Ubuntu/Debian (UFW) and CentOS/AlmaLinux (firewalld).

Firewall Basics

A firewall filters network traffic based on rules:

Inbound rules — Control traffic coming into your server (e.g., web requests, SSH connections).
Outbound rules — Control traffic leaving your server (e.g., API calls, DNS lookups).
Default policy — What happens to traffic that does not match any rule (typically deny).

The principle of least privilege applies: only allow traffic that is specifically needed.

UFW (Ubuntu / Debian)

UFW (Uncomplicated Firewall) provides a simple interface for managing iptables rules.

Initial Setup

# Install UFW (usually pre-installed)
sudo apt install ufw -y
Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing
Allow SSH before enabling (critical!)
sudo ufw allow ssh
Enable the firewall
sudo ufw enable

Common Rules

# Allow SSH (port 22)
sudo ufw allow ssh
Allow HTTP (port 80)
sudo ufw allow 80/tcp
Allow HTTPS (port 443)
sudo ufw allow 443/tcp
Allow a custom port
sudo ufw allow 8080/tcp
Allow from a specific IP
sudo ufw allow from 203.0.113.50
Allow from a specific IP to a specific port
sudo ufw allow from 203.0.113.50 to any port 3306
Allow a port range
sudo ufw allow 6000:6010/tcp
Deny a specific port
sudo ufw deny 23/tcp
Delete a rule
sudo ufw delete allow 8080/tcp

View Active Rules

sudo ufw status verbose
sudo ufw status numbered

Rate Limiting SSH

Protect against brute-force SSH attacks:

sudo ufw limit ssh

This limits SSH connections to 6 per 30 seconds from a single IP.

firewalld (CentOS / AlmaLinux)

firewalld uses zones and services for flexible firewall management.

Initial Setup

# Start and enable firewalld
sudo systemctl start firewalld
sudo systemctl enable firewalld
Check default zone
sudo firewall-cmd --get-default-zone
List current rules
sudo firewall-cmd --list-all

Common Rules

# Allow SSH
sudo firewall-cmd --permanent --add-service=ssh
Allow HTTP and HTTPS
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
Allow a custom port
sudo firewall-cmd --permanent --add-port=8080/tcp
Allow from a specific IP
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.50" accept'
Allow a specific IP to a specific port
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.50" port port="3306" protocol="tcp" accept'
Remove a rule
sudo firewall-cmd --permanent --remove-service=http
Reload to apply changes
sudo firewall-cmd --reload

Essential Firewall Rules by Service

Web Server

# UFW
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
firewalld
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Database (Allow Only Localhost)

Databases should not be exposed to the internet. Keep port 3306 (MySQL) or 5432 (PostgreSQL) blocked externally.

If you need remote database access, allow only specific IPs:

# UFW — allow MySQL from a specific server
sudo ufw allow from 203.0.113.20 to any port 3306
firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.20" port port="3306" protocol="tcp" accept'

Mail Server

# SMTP, IMAP, POP3 with SSL
sudo ufw allow 25/tcp
sudo ufw allow 465/tcp
sudo ufw allow 587/tcp
sudo ufw allow 993/tcp
sudo ufw allow 995/tcp

Advanced Hardening

Block ICMP Flood (Ping)

For servers that do not need to respond to ping:

# UFW — edit /etc/ufw/before.rules and change ACCEPT to DROP for ICMP
sudo nano /etc/ufw/before.rules

Log Dropped Packets

Enable logging to monitor blocked connections:

# UFW
sudo ufw logging on
firewalld
sudo firewall-cmd --set-log-denied=all

Logs appear in /var/log/syslog (Ubuntu) or /var/log/messages (CentOS).

Block Known Malicious IPs

sudo ufw deny from 192.0.2.100

Docker and Firewalls

Docker bypasses UFW by default, manipulating iptables directly. See Installing Docker & Docker Compose for Docker-specific firewall configuration.

Testing Your Firewall

After configuring rules:

Test allowed services — Verify web pages load, SSH connects, etc.

Test blocked ports — Use an external port scanner to confirm blocked ports.

Test from specific IPs — If you created IP-based rules, test from both allowed and blocked IPs.

# From another machine, test if a port is open
nc -zv 203.0.113.10 22
nc -zv 203.0.113.10 3306

What to Do Next

SSH Key Best Practices — Secure SSH access.
DDoS Protection — Additional network protection.
Complete Server Security Checklist — Full security review.
Firewall Blocking Legitimate Traffic — Troubleshoot rules.

Was this article helpful?

← Back to Security Browse all categories →

Still have questions?

Contact Support →Submit a Ticket