The firewall on both families, and what survives a reload
Domain 3 names firewalls and the two families ship different ones in opposite states. This guide protects a real service on one host and tests it from another: rules added while ufw is off, the firewall switched on without losing SSH, the timeout that proves a packet was dropped rather than refused, and firewalld's runtime configuration being discarded by a reload.
Security Guide 15 of 28 Intermediate
- PlatformsUbuntu 26.04 LTS + AlmaLinux 10.2
- Mandatory access controlAppArmor on Ubuntu, SELinux enforcing on Alma
- Firewallufw / nftables 1.1.6
- TimeAbout 24 min
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| LPLUS-A01 | 192.168.0.73 | Ubuntu 26.04 LTS | Debian-family host - apt, ufw, netplan, AppArmor | 2 Core | 4 GB | 50 GB |
| LPLUS-B01 | 192.168.0.74 | AlmaLinux 10.2 | RPM-family host - dnf, firewalld, NetworkManager, SELinux | 2 Core | 4 GB | 50 GB |
| LPLUS-C01 | 192.168.0.75 | Ubuntu 26.04 LTS | Second Debian host - so networking and ssh have two ends | 2 Core | 4 GB | 50 GB |
This guide includes
Use this before opening or closing a port on a machine you reach over the network. This matters because the two families disagree about defaults and about persistence: a firewalld rule added the obvious way is gone at the next reload, and a ufw rule added before the firewall is enabled does nothing at all until it is.
- reading the state of both front ends, and finding the one kernel subsystem underneath
- adding rules while the firewall is still off, and proving they have no effect yet
- enabling it without losing the SSH session you are working in
- telling a dropped packet from a refused one by the client's exit code
- meeting firewalld's runtime and permanent split, and making a rule survive a reload
Before you start
- keys-certificates-and-what-the-server-allows
-
Two front ends, one kernel underneath
-
A service worth protecting
-
Rules exist before the firewall does
-
Turning it on without losing the host
-
The RPM family, runtime against permanent
-
Putting both machines back