Linux Firewalls: How to Actually Secure a Cloud Server (iptables, nftables, firewalld, ufw)

https://blog.hofstede.it/linux-firewalls-how-to-actually-secure-a-cloud-server-iptables-nftables-firewalld-ufw/

83 points · 10 comments · view on lemmy.world

10 Comments

Nester@feddit.uk · 14 pts · 22d (1 reply)

I didn't realise I wanted to read up about Linux firewalls, but apparently I did. Thanks

BeardedGingerWonder@feddit.uk · 3 pts · 22d

I've wanted to for years. I've tried to multiple times. Like I love computers and programming I can get absolutely lost in code for hours. For whatever reason when I start to look at networking my brain switches off and says nope. I can clean enough to hack what I need for the most part, but of I strive for any depth of knowledge on the subject my brain shuts down.

Hoping this article is the ticket.

ImgurRefugee114@reddthat.com · 8 pts · 22d (5 replies)

networking.firewall.enable = true; ::: spoiler Tap for spoiler Yeah I'm familiar with all the tools but - omg - have NixOS modules ever changed my life :::

esc@piefed.social · 3 pts · 22d (4 replies)

What does it do?

Gregers@lemmy.world · 8 pts · 22d (3 replies)

Deletes /dev/null obviously

esc@piefed.social · 3 pts · 22d (2 replies)

For me it's clearly not obvious what exactly 'enabling firewall' entails, what policy is applied, what rules, etc., etc.

ImgurRefugee114@reddthat.com · 3 pts · 22d (1 reply)

There are sensible defaults but it ultimately depends on what the module is doing and how you configure it.

https://github.com/NixOS/nixpkgs/blob/8c91a71d13451abc40eb9dae8910f972f979852f/nixos/modules/services/networking/firewall.nix

The beauty is that this, or your own custom modules, become a declarative and reproducible abstraction layer which (if properly written) lets you focus on the what rather than the how.

... You could also write a bunch of scripts, which is what I used to do before I joined the cult.

esc@piefed.social · 3 pts · 21d

Nftables rulesets are reproducible and let you focus on what rather than how. I've tried nix some time ago, conceptually cool distro, but it requires a lot of time, time that can be used configuring emacs 😝.

moonpiedumplings@programming.dev · 6 pts · 22d

On all modern linux's, the iptables command is actually a compatibility layer controlling nftables.

I prefer it over the nft command because it's much easier to read and use. I only use the nft command when checking for the occasional chain/table that iptables didn't show me.

Laser@feddit.org · 2 pts · 22d

No mention of bpfilter unfortunately, would have been helpful to get a rough overview