Firewall on Linux: nftables, ufw and firewalld

In short: The firewall in the Linux kernel is called Netfilter. It is operated with nftables (successor to iptables) or simple front ends: ufw (Ubuntu) and firewalld (Fedora, RHEL).

In more detail: Rules decide which connections may come in and go out. Good basic rule: block everything incoming, open only required services.

In detail

# ufw (simple)
sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose
 
# firewalld
sudo firewall-cmd --add-service=https --permanent
sudo firewall-cmd --reload
 
# nftables
sudo nft list ruleset

• iptables: older tool, today often a layer on top of nftables.
• Stateful tracking: replies to your own connections are automatically allowed (established,related).
• Zones (firewalld): networks with different trust levels (home, public).
• Docker: publishes ports past ufw, check rules separately.
• Test: nmap from outside, ss -tulpn from inside.
• Server hardening: additionally fail2ban against dictionary attacks on SSH.

See also: Firewall, Networking on Linux: ip, NetworkManager and DNS