World map

 

BM

World L3: Phone Lines

Firewalls: ufw and nftables

You will learn: how a firewall guards the door, and how to open one port safely.

Checked with Linux (Debian 13) on 1 Nov 2026

The problem

You are hereyou@kedai:~$

Folder ~

Empty folder

+ 3 hidden (ls -a)

Services

  • cronrunningstarts at boot
  • sshrunningstarts at boot
  • nginxrunningstarts at boot

Phone lines (network) Address 10.0.0.5

Listening ports

  • :22 sshd
  • :80 nginx

This call waited more than two minutes, then gave up. Nobody said no. Nobody said yes. Who stays silent like that?

Watch

kedai
sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip
To Action From
-- ------ ----
22/tcp (OpenSSH) ALLOW IN Anywhere
80/tcp ALLOW IN Anywhere

A firewall is the guard at the door. ufw is Debian’s easy guard. It keeps everyone out, except the extensions on its list.

Try it

You are on the server over SSH. Turning the guard on first would lock you out! Put the steps in a safe order.

First step at the top. Put these in order. Use the arrows, or drag.

  • sudo ufw status verbose
  • sudo ufw allow OpenSSH
  • sudo ufw allow 80/tcp
  • sudo ufw enable

Watch

kedai (over SSH)
sudo ufw allow OpenSSH
Rules updated
sudo ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup

ufw asks before it starts. Answer y only when SSH is on the list.

Try it

Compare two shops. First closed.kedai.example. Then guarded.kedai.example with --connect-timeout 5, so you wait only 5 seconds.

You are hereyou@kedai:~$

Folder ~

Empty folder

+ 3 hidden (ls -a)

Services

  • cronrunningstarts at boot
  • sshrunningstarts at boot
  • nginxrunningstarts at boot

Phone lines (network) Address 10.0.0.5

Listening ports

  • :22 sshd
  • :80 nginx

Check

Real curl errors. Which rung is each one?

Drag a card into a box. Or tap the card, then tap the box.

        Check

        Only your office, 198.51.100.7, may use port 3000. Which rule?

        You did it!

        You can now read a firewall’s list and open one port without locking yourself out.

        Go deeper (optional)

        Under ufw sits nftables, the kernel’s rule list (sudo nft list ruleset). Cloud firewalls sit outside the server: both must allow a port. Careful: ports published by Docker skip ufw’s rules. The ufw outputs here came from a real Debian 13 lab.

        Real mission

        2. sudo apt install ufw
        3. sudo ufw allow OpenSSH
        4. sudo ufw enable && sudo ufw status verbose

        0 of 4 steps done · Your ticks are saved.