Cybersecurity — Firewalls

Types of firewalls

1. Packet filtering: Basic traffic rules
2. Stateful: Track connection states
3. Application: Deep packet inspection
4. Next-gen: Advanced threat prevention

iptables

# Allow HTTP
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# Allow SSH
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

# Block all
iptables -P INPUT DROP

UFW (Ubuntu)

# Enable
sudo ufw enable

# Allow services
sudo ufw allow ssh
sudo ufw allow 80/tcp

# Status
sudo ufw status verbose

Firewall rules

# Rule structure
rules = [
    {'action': 'ALLOW', 'port': 22, 'protocol': 'tcp'},
    {'action': 'ALLOW', 'port': 80, 'protocol': 'tcp'},
    {'action': 'ALLOW', 'port': 443, 'protocol': 'tcp'},
    {'action': 'DENY', 'port': '*', 'protocol': '*'}
]

Best practices

1. Default deny policy
2. Allow only necessary ports
3. Log denied traffic
4. Regular rule review

Mini Practice

1. Configure iptables
2. Set up UFW
3. Create firewall rules
4. Test rule effectiveness

Up Next

Continue with IDS/IPS - Intrusion detection.