configuring-firewalls

Use UFW on Ubuntu: set default deny incoming, allow outgoing, then explicitly allow SSH before enabling with 'sudo ufw allow ssh' and 'sudo ufw enable'. Add service rules like 'sudo ufw allow https' and verify with 'sudo ufw status verbose'.

Security Groups are stateful, instance-level firewalls that only support allow rules and automatically permit return traffic. Network ACLs are stateless, subnet-level controls supporting both allow and deny rules, evaluated sequentially, and require explicit ephemeral port rules (1024-65535) for return traffic.

Use nftables on modern kernels (4.14+) for better O(log n) performance and unified IPv4/IPv6/NAT syntax. Use iptables only on legacy systems with older kernels, and plan migration to nftables when feasible.

Always add an SSH allow rule before enabling the firewall, test rules in a staging environment first, and ensure you have console access (cloud) or physical/IPMI access (on-prem) as a recovery path. Use 'sudo ufw limit ssh' for rate limiting against brute force.

Configure the database firewall to allow the database port (e.g., 5432 for PostgreSQL) only from application server IPs or security groups, deny all other inbound traffic, and restrict outbound traffic to the local VPC. Never expose database ports to 0.0.0.0/0.

NACLs are stateless, so return traffic on ephemeral ports must be explicitly allowed. Add inbound and outbound rules permitting TCP ports 1024-65535, and verify rule ordering since NACLs evaluate rules sequentially with first match winning.