6.1Packet Filtering with iptables/firewalld

Once a server faces the outside world, a firewall must state clearly what traffic passes and what is blocked. On Linux, iptables is the traditional way to drive the kernel's packet filter directly, while firewalld and ufw wrap it in more manageable zones and services.

6.1.1iptables/ip6tables fundamentals

• iptables configures the IPv4 packet filter. ip6tables is the IPv6 counterpart—a separate command with a separate ruleset (IPv4 rules do not apply to IPv6 traffic).
• Kernel forwarding and response behavior is controlled via virtual files under /proc/sys/net/ipv4/ and /proc/sys/net/ipv6/ (e.g., setting net.ipv4.ip_forward to 1 enables routing).
• The routing table decides where a packet goes; the firewall permits or denies traffic around that decision. Port redirection (destination port translation) is done in the NAT table's PREROUTING chain; /etc/services maps port numbers to service names.

6.1.2firewalld, ufw, and persistence

• firewalld is a dynamic firewall service managed through firewall-cmd. Network interfaces are assigned to zones (public, internal, trusted, etc.), and each zone allows specific services or ports.
• ufw (Uncomplicated Firewall) is a simpler command front end over iptables, e.g., ufw allow 22/tcp to add a rule intuitively.
• iptables rules live only in memory and vanish on reboot, so iptables-save dumps them to a file and iptables-restore reloads them—typically wired into a distro service to apply automatically at boot.

Consider a common requirement: block external SSH to an internal web server while allowing it from the internal segment. With raw iptables, place source-restricted ACCEPT rules early in the filter table's INPUT chain, with a default DROP/REJECT at the end catching everything else. The same intent in firewalld assigns the internal-facing interface to the internal zone and the external-facing interface to public, allowing the ssh service only in the internal zone (firewall-cmd --zone=internal --add-service=ssh --permanent, then firewall-cmd --reload). Port forwarding (e.g., external port 8080 to an internal web server's port 80) is destination translation (DNAT) in the NAT table's PREROUTING chain; firewalld exposes the same idea via --add-forward-port. If you also run IPv6, remember that iptables rules do not carry over to ip6tables, so IPv6-specific traffic such as ICMPv6 neighbor discovery needs its own rules in ip6tables—an easy detail to miss. After validating the setup, persist it so a reboot does not undo it: dump with iptables-save > /etc/sysconfig/iptables and wire iptables-restore into startup.

6.1.3Section summary

• iptables = IPv4 / ip6tables = IPv6 (separate rulesets); persist with iptables-save / iptables-restore
• firewalld = zone-based (firewall-cmd, --permanent + --reload) / ufw = simplified commands; port mapping via /etc/services