100 lines
4.1 KiB
Markdown
100 lines
4.1 KiB
Markdown
# Firewall – Basics
|
||
|
||
What a firewall does, how packet filtering works, and the relationship between ports and rules.
|
||
|
||
For generic networking concepts, see:
|
||
|
||
- [Network / Basics](./Basics.md)
|
||
|
||
---
|
||
|
||
## Scope
|
||
|
||
- What a firewall is and why it matters.
|
||
- Stateless vs stateful filtering.
|
||
- Inbound vs outbound rules.
|
||
- How ports relate to firewall rules.
|
||
- Linux firewall tooling.
|
||
|
||
---
|
||
|
||
## 1. What Is a Firewall?
|
||
|
||
A **firewall** is a system that controls which network traffic is allowed to pass, based on a set of rules. It can run on a dedicated appliance, a router, or directly on the host OS.
|
||
|
||
Rules are evaluated against packet attributes:
|
||
|
||
- Source and destination IP address.
|
||
- Source and destination port.
|
||
- Protocol (TCP or UDP).
|
||
- Connection state.
|
||
|
||
Traffic that does not match any allow rule is typically **dropped** (silently discarded) or **rejected** (a "connection refused" response is sent back).
|
||
|
||
---
|
||
|
||
## 2. Stateless vs Stateful Filtering
|
||
|
||
### 2.1 Stateless
|
||
|
||
Each packet is evaluated independently. The firewall has no memory of previous packets.
|
||
|
||
Simple and fast, but incomplete: to allow a TCP connection, you would need to explicitly create rules in both directions, since the response packets are separate.
|
||
|
||
### 2.2 Stateful (Connection Tracking)
|
||
|
||
The firewall tracks the state of each connection. It knows whether a packet is:
|
||
|
||
- **NEW** — initiating a new connection.
|
||
- **ESTABLISHED** — part of an already-allowed connection.
|
||
- **RELATED** — related to an existing connection (for example an FTP data channel).
|
||
|
||
This makes rules much simpler: allow NEW connections matching certain criteria, and the return traffic (ESTABLISHED/RELATED) is automatically let through. Most modern host firewalls are stateful, including Linux `nftables` and `iptables`.
|
||
|
||
---
|
||
|
||
## 3. Inbound vs Outbound Rules
|
||
|
||
- **Inbound (ingress)** — traffic arriving at the machine from outside. This is where most filtering happens: blocking access to ports that should not be public.
|
||
- **Outbound (egress)** — traffic leaving the machine. Often unrestricted on home or personal servers, but can be tightened in high-security environments.
|
||
|
||
---
|
||
|
||
## 4. Ports and Firewall Rules
|
||
|
||
"Opening a port" means adding an inbound rule to allow traffic on that port number to reach the service listening on it.
|
||
|
||
Example rule set:
|
||
|
||
| Action | Protocol | Port | Source | Effect |
|
||
|--------|----------|-------|-------------------|-------------------------------------------|
|
||
| ALLOW | TCP | 443 | any | Anyone can reach the HTTPS reverse proxy |
|
||
| ALLOW | TCP | 80 | any | HTTP (redirect to HTTPS) |
|
||
| ALLOW | TCP | 22 | 192.168.1.0/24 | SSH only from the local network |
|
||
| ALLOW | UDP | 51820 | any | WireGuard peers can connect |
|
||
| DROP | TCP | 5432 | any | PostgreSQL is not accessible externally |
|
||
|
||
Good practice: only allow ports that are actively needed. Every exposed port is a potential attack surface.
|
||
|
||
---
|
||
|
||
## 5. Linux Firewall Tooling
|
||
|
||
Linux manages packet filtering through **Netfilter**, a subsystem built into the kernel. Several tools provide a user-space interface to it:
|
||
|
||
| Tool | Description |
|
||
|-------------|---------------------------------------------------------------------------------------|
|
||
| `iptables` | The classic interface to Netfilter. Still widely used, but being replaced by `nftables`. |
|
||
| `nftables` | The modern replacement for `iptables`. Cleaner syntax, better performance. |
|
||
| `ufw` | "Uncomplicated Firewall" — a simplified front-end for `iptables`. Good for basic setups. |
|
||
| `firewalld` | Dynamic firewall manager used on RHEL/Fedora systems. |
|
||
|
||
On Debian, `ufw` or direct `nftables` rules are the most common choices.
|
||
|
||
---
|
||
|
||
## Notes / TODO
|
||
|
||
- Document the actual firewall rules in use on the home server (ports 80, 443, 22, 51820).
|
||
- Create `Home-Server/Implementations/Firewall.md` once the setup is confirmed.
|