- So let me give you an overview of Linux firewalling.
It all starts with the kernel.
In the kernel, there is this functionality
called net filter.
And net filter is the packet filtering
that makes sure that packets are going to pass
through the kernel.
Now, in order to do so,
there are the different flows of packages.
We have input.
We have forward for routing.
And we have output.
These are the different directions
that the kernel is going to track.
Now, you need to define what you want to allow to come in,
what you want to allow in this forward,
and what you want to allow
in this output phase of the firewall.
So if you look at the essential utilities,
there was always iptables.
And nowadays, that has been replaced with nftables.
These are low end utilities.
They are pretty complex.
And because they are so complex,
they are not used a lot.
In order to write these firewall rules
in a much easier way,
nowadays, distributions are providing firewalld
or ufw,
where firewalld is the default in Red Hat
and ufw is the default in Ubuntu.
So what is happening?
Well, firewalld or ufw writes to iptables or nftables
depending on the Linux distribution that you are using,
and these on their turn
are defining these input, output, and forward rules.
And that's how firewalling in Linux is organized.