Add network & containerisation

Doc/Network/Firewall.md

@@ -0,0 +1,99 @@
+# Firewall – Basics
+
+What a firewall does, how packet filtering works, and the relationship between ports and rules.
+
+For generic networking concepts, see:
+
+- [Network / Basics](./Basics.md)
+
+---
+
+## Scope
+
+- What a firewall is and why it matters.
+- Stateless vs stateful filtering.
+- Inbound vs outbound rules.
+- How ports relate to firewall rules.
+- Linux firewall tooling.
+
+---
+
+## 1. What Is a Firewall?
+
+A **firewall** is a system that controls which network traffic is allowed to pass, based on a set of rules. It can run on a dedicated appliance, a router, or directly on the host OS.
+
+Rules are evaluated against packet attributes:
+
+- Source and destination IP address.
+- Source and destination port.
+- Protocol (TCP or UDP).
+- Connection state.
+
+Traffic that does not match any allow rule is typically **dropped** (silently discarded) or **rejected** (a "connection refused" response is sent back).
+
+---
+
+## 2. Stateless vs Stateful Filtering
+
+### 2.1 Stateless
+
+Each packet is evaluated independently. The firewall has no memory of previous packets.
+
+Simple and fast, but incomplete: to allow a TCP connection, you would need to explicitly create rules in both directions, since the response packets are separate.
+
+### 2.2 Stateful (Connection Tracking)
+
+The firewall tracks the state of each connection. It knows whether a packet is:
+
+- **NEW** — initiating a new connection.
+- **ESTABLISHED** — part of an already-allowed connection.
+- **RELATED** — related to an existing connection (for example an FTP data channel).
+
+This makes rules much simpler: allow NEW connections matching certain criteria, and the return traffic (ESTABLISHED/RELATED) is automatically let through. Most modern host firewalls are stateful, including Linux `nftables` and `iptables`.
+
+---
+
+## 3. Inbound vs Outbound Rules
+
+- **Inbound (ingress)** — traffic arriving at the machine from outside. This is where most filtering happens: blocking access to ports that should not be public.
+- **Outbound (egress)** — traffic leaving the machine. Often unrestricted on home or personal servers, but can be tightened in high-security environments.
+
+---
+
+## 4. Ports and Firewall Rules
+
+"Opening a port" means adding an inbound rule to allow traffic on that port number to reach the service listening on it.
+
+Example rule set:
+
+| Action | Protocol | Port  | Source            | Effect                                    |
+|--------|----------|-------|-------------------|-------------------------------------------|
+| ALLOW  | TCP      | 443   | any               | Anyone can reach the HTTPS reverse proxy  |
+| ALLOW  | TCP      | 80    | any               | HTTP (redirect to HTTPS)                  |
+| ALLOW  | TCP      | 22    | 192.168.1.0/24    | SSH only from the local network           |
+| ALLOW  | UDP      | 51820 | any               | WireGuard peers can connect               |
+| DROP   | TCP      | 5432  | any               | PostgreSQL is not accessible externally   |
+
+Good practice: only allow ports that are actively needed. Every exposed port is a potential attack surface.
+
+---
+
+## 5. Linux Firewall Tooling
+
+Linux manages packet filtering through **Netfilter**, a subsystem built into the kernel. Several tools provide a user-space interface to it:
+
+| Tool        | Description                                                                           |
+|-------------|---------------------------------------------------------------------------------------|
+| `iptables`  | The classic interface to Netfilter. Still widely used, but being replaced by `nftables`. |
+| `nftables`  | The modern replacement for `iptables`. Cleaner syntax, better performance.             |
+| `ufw`       | "Uncomplicated Firewall" — a simplified front-end for `iptables`. Good for basic setups. |
+| `firewalld` | Dynamic firewall manager used on RHEL/Fedora systems.                                  |
+
+On Debian, `ufw` or direct `nftables` rules are the most common choices.
+
+---
+
+## Notes / TODO
+
+- Document the actual firewall rules in use on the home server (ports 80, 443, 22, 51820).
+- Create `Home-Server/Implementations/Firewall.md` once the setup is confirmed.