this post was submitted on 12 Jul 2026

164 points (98.2% liked)

Technology

86387 readers

3407 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related news or articles.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago

MODERATORS

L3s@lemmy.world

enu@lemmy.world

technopagan@lemmy.world

L4s@lemmy.world

L3s@hackingne.ws

164

Linux Firewalls: How to Actually Secure a Cloud Server (iptables, nftables, firewalld, ufw) (blog.hofstede.it)

submitted 4 days ago by lemmydividebyzero@reddthat.com to c/technology@lemmy.world

19 comments fedilink hide all child comments

top 19 comments

sorted by: hot top controversial new old

[–] heartSagan5@lemmy.zip 14 points 4 days ago

iptables and nftables are just different frontends to the netfilter kernel module.

[–] ohshit604@sh.itjust.works 19 points 4 days ago* (last edited 4 days ago) (2 children)

OpenSnitch is a nice for the desktop environment, deny by default and prompts the user when an application requests a open port, at first the prompts can get a little overwhelming given how many things want to connect to xyz server but eventually lightens up.

[–] prenatal_confusion@feddit.org -2 points 4 days ago (1 children)

I really dont like the idea that a program on my local os doing things I don't want it to do and the only thing stopping it is a software firewall.

If you don't trust the platform then you shouldn't be using it. No bandaid like antivirus or firewall can help with that.

[–] ohshit604@sh.itjust.works 7 points 4 days ago* (last edited 4 days ago) (1 children)

If you don't trust the platform then you shouldn't be using it. No bandaid like antivirus or firewall can help with that.

I mean, if you don’t have a firewall on the device itself then your router certainly does, your device requests xyz port open your router will oblige with UPNP unless explicitly denied.

The on-device firewall is just an extra step before it hits your router’s firewall anyways, I’m sure your devices have made contact with servers behind your back that you know nothing about.

[–] prenatal_confusion@feddit.org 0 points 4 days ago

I absolutely agree that additional security layers are useful and even necessary. A software firewall on the device itself just isn't one of them. For me.

[–] Jason2357@lemmy.ca -2 points 4 days ago (4 children)

Its a little annoying on Linux but I wonder what it would be like on Windows.

[–] Dnb@lemmy.dbzer0.com 9 points 4 days ago

Windows firewall already does prompt like this

[–] ohshit604@sh.itjust.works 3 points 4 days ago* (last edited 4 days ago)

The firewall is annoying? I would argue and say the firewall is protecting your computer from connecting to a rouge server, annoying or not it’s better than some douche abusing an exploit in your system.

[–] makeshift0546@lemmy.today 2 points 4 days ago* (last edited 4 days ago)

Trivial. It pops up, you click.

[–] MonkderVierte@lemmy.zip 2 points 4 days ago (1 children)

Glasswire and Tinywall(?) are like this.

[–] lemonuri@infosec.pub 2 points 4 days ago (1 children)

Simplewall works great, it's open source. And yes, there are a couple of million requests made by windows apps alone, which are completely fine to block. Simplewall also blocks windows telemetry. I have to use win11 at work and it's an absolute ahitstorm of network requests that you don't get to see when using windows firewall.

Glaswire looks beautiful and functions well, but you will hit the paywall after a couple of weeks (I used this on the around 2010 I think)

[–] MonkderVierte@lemmy.zip 1 points 4 days ago

Right, Simplewall, not Tinywall.

[+] hypna@lemmy.world -8 points 4 days ago (3 children)

These firewall tools are interesting, but I honestly haven't needed them in years. The premise is a little out of date. Who puts cloud servers on the open internet these days? Everything I see uses a public load balancer and a WAF service.

[–] 0x0@infosec.pub 22 points 4 days ago (1 children)

Sure, but what if youve configured your waf or w/e incorrectly, what if someone gains access to another part of your network? Having sane firewall settings is always better than none at all.

[–] hypna@lemmy.world 1 points 4 days ago

All the cloud services I've used had virtual network firewalls for internal traffic. Security Groups for AWS, Cloud Firewall for GCP, etc. That's typically how lateral traffic gets managed. Defense in depth is good, but as I said I haven't used host firewalls in forever, and we get audited for security certificates every year, and no auditor has asked about them that I recall.

[–] Jason2357@lemmy.ca 9 points 4 days ago* (last edited 4 days ago) (1 children)

A lot of people host websites created with a static site generator just fine without that extra layer. Unless your site has expensive to generate dynamic pages, lots of video content, or deep changelog pages (wiki history or forge commit diff's publicly available), it makes a lot of sense to keep it simple.

Putting everything behind Cloudflare is just cargo cult behaviour and learning all the ins and outs of it isnt any harder than learning a firewall (which is transferrable knowledge that can also protect your machines from each other).

[–] boatswain@infosec.pub 1 points 4 days ago

Cloudflare WAF maybe, but Cloudflare ZTNA means zero open inbound ports for your static site, which is pretty cool.

[–] eleijeep@piefed.social 8 points 4 days ago (1 children)

If you're trying to be cost-effective, renting a VPS for a fixed term instead of using a IaaS platform that provides all these things just by clicking a checkbox, then caring about your firewall is a necessary part of building the system image that you deploy. You can of course set up your own private networking between systems and build the same type of architecture that a IaaS would provide, but to do that you're going to need to understand everything about linux networking and netfilter already.

[–] hypna@lemmy.world 0 points 4 days ago

Maybe that's the context. All of my cloud hosting work is very large corporate systems in the big three clouds. You're talking about Hostinger or Scalahosting type services, yes?