How to Set Up a Firewall on Your Web Server: Complete Guide

Step 1: Install and configure UFW

# Install UFW (usually pre-installed on Ubuntu)
sudo apt update && sudo apt install ufw -y

# Set default policies, deny incoming, allow outgoing
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH BEFORE enabling (critical, don't lock yourself out!)
sudo ufw allow 22/tcp comment 'SSH access'

# Allow web traffic
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'

# Enable the firewall
sudo ufw enable

# Verify rules
sudo ufw status verbose

Step 2: Advanced UFW rules

# Allow SSH only from your IP (replace with your IP)
sudo ufw allow from 203.0.113.50 to any port 22 proto tcp

# Rate-limit SSH to prevent brute force (6 connections/30s)
sudo ufw limit 22/tcp

# Allow a specific subnet (office network)
sudo ufw allow from 10.0.0.0/24 to any port 3306 comment 'MySQL from office'

# Deny a specific IP
sudo ufw deny from 192.168.1.100

# Delete a rule by number
sudo ufw status numbered
sudo ufw delete 3

# Enable logging
sudo ufw logging on

# Install firewalld (usually pre-installed)
sudo dnf install firewalld -y

# Start and enable
sudo systemctl start firewalld
sudo systemctl enable firewalld

# Check default zone
sudo firewall-cmd --get-default-zone

# Allow web services (permanent)
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --permanent --add-service=ssh

# Remove unnecessary services
sudo firewall-cmd --permanent --remove-service=dhcpv6-client
sudo firewall-cmd --permanent --remove-service=cockpit

# Allow custom port
sudo firewall-cmd --permanent --add-port=8443/tcp

# Restrict SSH to specific IP
sudo firewall-cmd --permanent --add-rich-rule='
  rule family="ipv4"
  source address="203.0.113.50/32"
  service name="ssh" accept'

# Apply changes
sudo firewall-cmd --reload

# Verify active rules
sudo firewall-cmd --list-all

Production-ready iptables ruleset

#!/bin/bash
# Flush existing rules
iptables -F
iptables -X

# Default policies: drop incoming, allow outgoing
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow established connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow SSH (rate-limited)
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW \
  -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW \
  -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow HTTP and HTTPS
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow ICMP (ping), rate-limited
iptables -A INPUT -p icmp --icmp-type echo-request \
  -m limit --limit 1/s --limit-burst 4 -j ACCEPT

# Drop invalid packets
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

# Log dropped packets (last 5/min to avoid log flooding)
iptables -A INPUT -m limit --limit 5/min -j LOG \
  --log-prefix "iptables-dropped: " --log-level 4

# Save rules (Debian/Ubuntu)
iptables-save > /etc/iptables/rules.v4

Install and configure Fail2Ban

# Install Fail2Ban
sudo apt install fail2ban -y   # Debian/Ubuntu
sudo dnf install fail2ban -y   # CentOS/RHEL

# Create local config (never edit jail.conf directly)
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

# Edit jail.local
sudo nano /etc/fail2ban/jail.local

/etc/fail2ban/jail.local, recommended settings

[DEFAULT]
bantime  = 3600      # Ban for 1 hour
findtime = 600       # Within 10-minute window
maxretry = 3         # After 3 failures
banaction = ufw      # Use UFW for banning (or iptables-multiport)

# Whitelist your own IP
ignoreip = 127.0.0.1/8 ::1 203.0.113.50

[sshd]
enabled  = true
port     = ssh
logpath  = /var/log/auth.log    # Debian/Ubuntu
# logpath = /var/log/secure     # CentOS/RHEL
maxretry = 3

[nginx-http-auth]
enabled  = true
port     = http,https
logpath  = /var/log/nginx/error.log

[nginx-botsearch]
enabled  = true
port     = http,https
logpath  = /var/log/nginx/access.log
maxretry = 2

[nginx-limit-req]
enabled  = true
port     = http,https
logpath  = /var/log/nginx/error.log

Managing Fail2Ban

# Start and enable
sudo systemctl start fail2ban
sudo systemctl enable fail2ban

# Check status of all jails
sudo fail2ban-client status

# Check specific jail
sudo fail2ban-client status sshd

# Unban an IP
sudo fail2ban-client set sshd unbanip 192.168.1.100

# Test regex against log file
sudo fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

Install ModSecurity with Nginx

# Install ModSecurity for Nginx (Ubuntu 22.04+)
sudo apt install libmodsecurity3 libmodsecurity-dev \
  libnginx-mod-http-modsecurity -y

# Download OWASP Core Rule Set
cd /etc/nginx/modsec
sudo git clone https://github.com/coreruleset/coreruleset.git
sudo cp coreruleset/crs-setup.conf.example crs-setup.conf

# Enable in nginx.conf
# Add inside server block:
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/main.conf;

# Test and reload
sudo nginx -t && sudo systemctl reload nginx

Restrict outbound traffic (iptables)

# Allow DNS lookups
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT

# Allow HTTP/HTTPS (for package updates, API calls)
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT

# Allow SMTP (if server sends email)
iptables -A OUTPUT -p tcp --dport 587 -j ACCEPT

# Allow NTP (time synchronization)
iptables -A OUTPUT -p udp --dport 123 -j ACCEPT

# Allow established connections
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Drop everything else
iptables -P OUTPUT DROP

# UFW logging levels
sudo ufw logging low     # Log blocked packets only
sudo ufw logging medium  # Log blocked + rate-limited
sudo ufw logging high    # Log everything (generates large logs)

# View UFW logs
sudo tail -f /var/log/ufw.log
sudo grep "UFW BLOCK" /var/log/ufw.log | tail -20

# firewalld logging
sudo firewall-cmd --set-log-denied=all  # Log all denied traffic

# View firewalld logs
sudo journalctl -u firewalld -f

# Count blocked IPs (top offenders)
grep "UFW BLOCK" /var/log/ufw.log | \
  awk '{for(i=1;i<=NF;i++) if($i ~ /SRC=/) print $i}' | \
  sort | uniq -c | sort -rn | head -20