CertGrid CertGrid
Hands-on Lab·Linux Foundation Certified System Administrator

The firewall, on both families

Two distributions, two firewall front ends, one kernel underneath. This guide shows both, explains the runtime-against-permanent split that catches everyone on firewalld, and demonstrates the one habit that stops you locking yourself out of a remote machine.

Networking Guide 26 of 38 Intermediate

ufw 0.36.2 with nftables 1.1.6 on Ubuntu, installed but inactive by default. firewalld with nftables 1.1.1 on RHEL 10, running by default. Both write nftables rules; neither uses iptables directly any more.

The firewall was enabled and disabled inside a single command, with 22/tcp allowed first. Both hosts end with exactly the firewall state they started with.
Server NameIP AddressOSRolesCPURAMHDD
LFCS-A01192.168.0.70Ubuntu 26.04 LTSPrimary host - most guides run only here2 Core4 GB50 GB
LFCS-C01192.168.0.72AlmaLinux 10.2The other distribution - dnf, firewalld and NetworkManager2 Core4 GB50 GB

This guide includes

Use this for the firewall marks on either distribution. This matters because a firewalld rule added at runtime disappears on reload - the runtime and permanent split is what catches everyone.

Before you start

  1. Two front ends, one kernel

  2. Rules exist before the firewall does

  3. Turning it on without losing the host

  4. Removing rules, and resetting

  5. firewalld, and the split that catches everyone

  6. Making a firewalld rule permanent, properly

Official sources

← All LFCS guides