Firewall (ufw/nftables literacy)
Host firewall concepts — ufw and nftables readouts on $LAB_HOST only.
Visual · linux_firewall
ufw/nftables literacy. $LAB_HOST only. Original Cyberlium.
iptables legacy, ufw friendly, nftables modern — defenders read rules on hosts they own.
Linux host firewalls filter packets with netfilter. ufw is a front-end on many distros; nftables is the modern ruleset backend. Defenders document default deny, allowed ports, and management access on owned servers. Cyberlium teaches ufw status verbose and nft list ruleset reading on $LAB_HOST — not blocking café Wi-Fi or 'testing' DROP rules on stranger VPS instances. Next: Linux Lab.
1. Default deny and explicit allow
Good baselines deny inbound by default and allow only required services (e.g., ssh from lab network). Read current posture on $LAB_HOST before adding rules.
Flushing rules on a production server you do not own is sabotage — not homework.
Command guide
Try these commands — Default deny and explicit allow
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Linux firewall — https://wiki.ubuntu.com/UncomplicatedFirewall iptables — https://www.netfilter.org/documentation/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install ufw sudo apt install iptables
Built-in (iproute2)
macOS: Use pfctl (built-in) Use: netstat
Windows: Use: netsh advfirewall Use: netstat
═══ LINUX / macOS ═══
Command — copy this
sudo ufw status verbose 2>/dev/null || sudo iptables -L -n 2>/dev/null | head -20 || echo 'Check firewall on YOUR Linux host' ss -tulpn 2>/dev/null | grep LISTEN | head -10
Primary tools to practice this lesson: ufw, iptables, ss. Reference sites: Linux firewall (https://wiki.ubuntu.com/UncomplicatedFirewall); iptables (https://www.netfilter.org/documentation/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. ufw vs nftables literacy
ufw status verbose shows enabled state and numbered rules on Ubuntu-like systems. nft list ruleset shows the underlying table/chain structure on modern distros.
Know both names for job interviews and incident response — apply changes only on $LAB_HOST.
3. Lab scope reminder
Optional: allow one lab port on $LAB_HOST with ufw allow and document revert. Never run nft flush on stranger hosts.
Ship: firewall enabled yes/no + allowed ports list for $LAB_HOST. Next: Linux Lab.
4. What you ship: firewall readout for $LAB_HOST
ufw or nft readout. Default policy and allowed ports. No stranger rule changes. chmod 600.
5. What you record before the next lesson
Date. Firewall tool and status on $LAB_HOST. File t16-m03-l03-linux-firewall.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: nft flush ruleset on cloud IP you found on Shodan. Block roommate's game port 'to learn DROP.'
- Right: Read firewall state on $LAB_HOST. Next: Linux Lab.
Mission: host firewall readout
1) Record whether host firewall is enabled on $LAB_HOST. 2) List allowed inbound ports (read-only). 3) Note ufw or nft command used. Never change stranger firewall rules.
Stuck? Ask Cyberlium AI Mentor
Document revert command before any ufw allow — lab VMs should be reversible.
APPLY: Default deny inbound means:
APPLY: True or False: nft flush ruleset on a stranger VPS is defensive practice.
APPLY: ufw status verbose is primarily for: