How Firewalls Work

A firewall is a security system designed to monitor and filter incoming (ingress) and outgoing (egress) network traffic based on predetermined security rules. It acts as an perimeter guard between your Linux server and untrusted external networks.

In this guide, we explore how firewalls process network packets, the difference between stateless and stateful inspection, and how host-based firewalls function on your RivinCloud VPS.

1. How Firewall Packet Inspection Works

When a network packet arrives at your server's Network Interface Card (NIC), the kernel firewall inspects the packet's headers against an active rule table:

Incoming Packet ──► [ Header Inspection ]
                           │
           ┌───────────────┴───────────────┐
           │ Matches an ALLOW rule?        │
           ▼                               ▼
       YES: Passed to App              NO: Evaluates Default Policy
                                           │
                                  ┌────────┴────────┐
                                  ▼                 ▼
                             DROP Packet      REJECT Packet
                            (Silent Ignore)  (ICMP Error Sent)

Header fields evaluated include:

1. Source IP Address: Where the packet originated.
2. Destination IP Address: Which local interface target.
3. Transport Protocol: TCP, UDP, or ICMP.
4. Destination Port: The targeted application port (e.g., 22, 80, 443).

2. Stateless vs Stateful Firewalls

Stateless Firewalls

Evaluates every network packet independently in isolation without tracking ongoing connection history. Fast, but less secure for complex multi-packet connections.

Stateful Firewalls (Modern Standard)

Tracks the state of active network connections (e.g., NEW, ESTABLISHED, RELATED).

• Once an outbound HTTP connection is established by your server, the firewall automatically permits incoming response packets belonging to that established session without needing manual inbound port rules!

3. DROP vs REJECT

When a firewall blocks an unauthorized packet, it can handle it in two ways:

• DROP (Recommended for Security): The firewall silently discards the packet without sending a response. Port scanners see the port as filtered and must wait for connection timeouts.
• REJECT: Discards the packet and returns an ICMP Destination Unreachable error to the sender. This informs legitimate clients instantly, but alerts attackers that a host is active.

Command of the Day: sudo ufw status verbose

The ufw status verbose command displays the complete operational state of the Uncomplicated Firewall on Linux.

Syntax

sudo ufw status verbose

Sample Output

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere

Explanation

This output verifies that UFW is active, enforcement defaults to deny incoming, and ports 22, 80, and 443 are allowed.

Common Mistakes

• Incorrect Rule Order: Placing a broad allow anywhere rule above specific deny rules. Firewalls evaluate rules sequentially from top to bottom!
• Disabling Firewalls entirely to solve connection issues: Always open specific ports rather than disabling firewall protection.

Troubleshooting

• Checking UFW block logs:

  sudo grep -i ufw /var/log/syslog | tail -n 20
  

Best Practices

• Enforce a strict Default Deny Incoming policy.
• Restrict administrative ports (like SSH or database management) to whitelisted IP addresses.

Frequently Asked Questions

What is the difference between UFW and iptables?

iptables (or modern nftables) is the underlying Linux kernel firewall engine. UFW is a user-friendly frontend CLI tool designed to simplify writing iptables rules.

Conclusion

Firewalls provide vital protection against unauthorized access. Keep your UFW rules organized and restrictive on your RivinCloud VPS!