Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
A packet filtering firewall gives Linux a simple way to sort traffic at the packet level. The kernel reads the header fields, checks them against its rules, and makes a decision that stays consistent under load. The logic isn’t fancy, but it shapes how the rest of the system handles new connections. . The process is predictable. Packets arrive, their basic fields get inspected, and the filtering layer decides whether they move forward or stop right there. No payload review. No protocol deep dive. Just enough structure for the system to keep its footing. This article lays out that foundation so beginners can see how the filtering layer actually works inside Linux. Once the basic packet path is clear, the behavior of higher-level firewall tools becomes easier to understand, even when the setup remains simple. What Is Packet Filtering? Packet filtering is a basic check the system performs on every packet that reaches the kernel. A packet filtering firewall focuses on the packet header. That header is a small block of fields that the packet carries everywhere. It holds the source and destination addresses. It notes the protocol. It records the ports tied to the exchange, and that tiny set of values is enough for Linux to sort traffic quickly without reaching deeper layers. These fields give the system the minimum it needs to sort traffic. Nothing more. The idea grew out of early network equipment that had to make quick decisions with limited resources. The pattern still holds. Internet background noise shows the same thing every day. Port scans, stray connection attempts, and misrouted packets all carry enough header data for the firewall to judge them without reading the payload. The kernel leans on that predictability. The decision itself follows a straight line. The packet arrives. The header fields are compared to the rules in order. The first rule that fits determines what happens next. Some packets move forward. Some stop immediately. It is the simplest filtering model Linux uses,and it sets the base layer for everything that comes after, including more advanced stateful checks. What a Packet Looks Like A packet filtering firewall only sees what is in the packet header. Everything else is invisible at this stage. Breaking the header down makes the filtering step easier to understand. IP header fields the firewall can read: Source address Destination address Protocol value Basic routing and lifetime fields These pieces tell the kernel where the traffic came from and what type of packet it is. Nothing in this layer describes the application itself. It is all structural data that the system can trust. TCP header fields: Source and destination ports Sequence and acknowledgment numbers Flags like SYN, ACK, FIN TCP gives the firewall a sense of how a connection is forming. A SYN flag signals a new attempt. A FIN signals a close. These are simple indicators, not full context, but they help the kernel understand the packet’s place in a flow. UDP header fields: Source and destination ports Length Checksum UDP offers less information than TCP. The firewall still gets ports and protocols, which is usually enough for basic filtering, but there is no concept of connection steps. Ports in plain terms: Port 443 commonly maps to encrypted web traffic Port 22 commonly maps to SSH The firewall treats these as numbers, not guarantees Ports give a hint about the service behind the packet. The system reads them as numeric fields, and no more. Flags in plain terms: A SYN marks the start of a TCP connection An ACK signals progress in the exchange A FIN marks the close Flags help the kernel place a packet in time. They don’t reveal intent or payload, but they shape the early decision. All Linux firewall tools interpret these same fields. Interfaces differ, but the packet does not. Even early questions about choosing a Linux firewall eventually circle back to this structurebecause the filtering decision begins and ends with what the header exposes. How Linux Evaluates Packets Linux follows a steady evaluation path inside the kernel. Packets move through a small set of checkpoints, and each checkpoint gives the system a chance to make a filtering decision before the packet reaches anything higher in the stack. Packet Flow Into Netfilter Every packet hits Netfilter as soon as the kernel receives it. Netfilter assigns the packet to a chain based on direction, which keeps local traffic, outbound traffic, and transit traffic from mixing together in the filtering path. Linux Firewall Chains Explained Linux relies on three core chains for packet evaluation. INPUT checks packets headed to the local machine. OUTPUT handles packets generated by the host. FORWARD governs packets passing through the system. These chains form the backbone of Linux filtering behavior. Linux Firewall Tables Overview Rules sit inside tables, each built for a specific task. The filter table drives allow or drop decisions. NAT and other tables exist, but beginners mainly need to know that packets only touch the tables relevant to their path. The structure keeps evaluation predictable, a pattern reflected across major Linux distributions, including the Red Hat packet filtering documentation , which outlines the same table-driven model. How Netfilter Makes Decisions Netfilter processes rules in order. The kernel reads from the top of the chain, stops at the first rule that matches, and applies that result. The rest of the chain never runs. This simple flow explains why two similar rules can yield different outcomes. Why Firewall Rule Order Matters A broad rule placed early can catch traffic before a more specific rule even appears in the evaluation path. The kernel is only following its first-match logic, yet the effect can be surprising. This is where topics like firewall rule ordering basics become useful for understanding real behavior. How Packet Evaluation Fits theFiltering Model All of these decision points rely on the same header fields described earlier. The chains and tables simply give Linux a structure for reading them. Once the packet’s path is clear, the rest of the filtering model becomes easier to map, even when different firewall tools present it in their own style. Stateful Packet Filtering and Connection Tracking Stateful filtering expanded what Linux could do with packet decisions. Instead of treating every packet as a separate event, the system tracks how a connection forms and uses that memory to guide later decisions. It is a small shift in logic that changes the whole filtering model. What Stateful Packet Filtering Means Stateful packet filtering keeps a record of traffic that has already been approved. A new packet is marked as the start of a connection. Follow-up packets are marked as established. Related packets fall into a secondary category that still fits the flow. The firewall can make better judgments because it knows where the packet sits in the conversation. What Connection Tracking Actually Does Connection tracking holds a lightweight entry for each active connection. It does not store payloads or application data. It just records enough detail for the kernel to match replies to earlier packets. This keeps the evaluation orderly. Tools aimed at beginners rely on this for predictable behavior, and topics like UFW basics highlight how the heavy lifting happens behind the scenes. Why Statefulness Matters in Linux Filtering Without statefulness, the firewall would need broad rules to avoid blocking normal traffic. With it, the system sees which packets belong to a valid exchange and which do not. Established traffic moves with minimal checks. New traffic gets a closer look. It is one of the core steps that moved Linux away from older, strictly stateless models. How nftables Evaluates Packets nftables reorganized how Linux handles filtering decisions. The firewall still checks packet headers the same way, butthe path is cleaner, and the evaluation work sits closer to the packet flow. This keeps the packet filtering model consistent across tools. Key parts of the nftables model: Hooks that follow the packet path: Hooks sit at points where the kernel already processes traffic. When a packet reaches one of these points, nftables runs the rules tied to that hook. It keeps the evaluation aligned with the packet’s direction without adding extra steps. Efficient matching structures: nftables uses sets that let the kernel match addresses and ports quickly. This avoids long walks through rule lists and holds up well when traffic increases or when rulesets grow larger. Simplified filtering logic: nftables keeps decisions in fewer places. Tables map cleanly to hooks, and each rule has a focused job. The layout is easier to read and makes the evaluation path more transparent. These shifts don’t change the underlying ideas. Linux still reads the header, checks the state, and makes a decision. For someone working through the firewall troubleshooting steps , it helps to know that nftables reorganizes the filtering path without changing the core ideas. Why Packet Filtering Matters in Linux Firewalling Packet filtering matters because it gives the kernel a stable first decision on every packet, and that early verdict shapes how the rest of the firewall stack behaves. It also forms a big part of the groundwork people learn when they first look into Linux firewall basics , since most later behavior traces back to this early check. It underpins the basics of Linux firewalls. The initial allow or drop decision frames the rest of the packet’s path. Once that call is made, later components build on it rather than re-evaluating the packet from scratch. It keeps higher-level tools consistent. UFW stays predictable because the kernel already marks traffic as new or established. nftables benefits from the same foundation. Its cleaner structure still depends on the packet’s earliestevaluation inside the kernel. It shapes the troubleshooting pattern. When traffic behaves in unexpected ways, analysts often start with this first checkpoint. The decisions made here ripple through every later stage, and workflows described in firewall troubleshooting steps eventually point back to this point. It supports both inbound and outbound control. The same header checks drive decisions in both directions. Outbound filtering uses the same logic as inbound control, and concepts explored in Egress filtering continue from that shared mechanism. Packet filtering ends up as the quiet anchor that keeps Linux firewall behavior consistent, even as rule sets and tools evolve around it. Common Misunderstandings About Packet Filtering A few misunderstandings show up early when people start looking at how Linux evaluates packets. Much of it comes from expecting a packet filtering firewall to see more than it actually can or from mixing up how different layers of the system behave. Assuming the firewall inspects full payloads: Packet filtering only reads the header. The contents stay untouched at this stage. Mixing up stateless checks with stateful behavior: The firewall tracks established traffic, but not every decision comes from connection state. The distinction is easy to blur. Expecting rules to run in the wrong chain: Packets follow a specific path. If traffic never reaches a chain, its rules never apply. Thinking the firewall sees more than the header provides: The system makes its call based on fields like addresses, ports, and protocols. Anything outside that view sits out of reach. Clearing these points early keeps the filtering model steady before moving into more advanced pieces of the firewall stack. Packet Filtering Firewall FAQ A few questions come up often when people start learning how packet filtering works in Linux. Does packet filtering inspect full packets? No. It only reviews the header fields. The payload stays untouched in thisstage of the process. Is packet filtering the same as a firewall? It’s one part of a firewall. Packet filtering provides the first decision point, but higher layers build on that foundation. Do modern firewalls still use packet filtering? Yes. Even with newer designs, the header check remains the starting point for how Linux decides what to do with a packet. Where Packet Filtering Fits in Your Overall Linux Firewall Knowledge Packet filtering sits at the base of Linux firewalling, and most of the system’s behavior traces back to this early inspection step. Once the packet’s path makes sense, the rest of the firewall stack settles into a clearer shape. Rule ordering starts to feel more predictable because you understand why the kernel reaches a decision when it does. Stateful checks, which build on the same packet flow, become easier to read once you see how new and established traffic forms at the header level. Even egress control and basic troubleshooting rely on this groundwork, since every later step depends on how the packet was first classified. Nothing in the next layer is more complicated. Each concept is just an extension of the logic introduced here, and the model holds up as the ruleset grows or the network gets louder. Packet filtering ends up being the foundation that keeps everything else steady. Once this layer makes sense, the rest of the firewall stack stops feeling unpredictable. . The process is predictable. Packets arrive, their basic fields get inspected, and the filtering laye. packet, filtering, firewall, gives, linux, simple, traffic, level, kernel. . MaK Ulac
Choosing a firewall on Linux looks simple until you try to match a tool to a real environment. Most teams already understand the basic types of firewalls, but the gap between a conceptual model and day-to-day usability can be wider than expected. A tool that feels lightweight on a workstation can become restrictive on a production host. Another that works well in distributed environments might be overkill when all you need is a small ruleset and predictable behavior. . Linux offers several mature options, each shaped by different assumptions about how administrators work. UFW favors clarity. iptables reflects years of legacy deployments. nftables streamlines policy design and replaces older components. firewalld tries to make large or changing systems easier to manage. None is universally the best Linux firewall, but each is the best fit for someone. This guide focuses on how to evaluate those differences without getting buried in packet flow charts or rule syntax. Our goal here is simpler. Identify what matters when selecting a firewall, explain how these tools differ in practice, and give you enough clarity to choose the one that aligns with your environment, your workflow, and your tolerance for complexity. What Do Firewalls Do in Linux? A firewall on Linux has one job. It decides what gets in, what goes out, and what stays on the cutting room floor. The mechanics vary across the different types of firewalls, but the outcome is the same. You are defining the boundaries of a system and the conditions under which traffic is allowed to cross them. Most teams working with Linux already understand this, yet it helps to reset the frame before comparing tools. A firewall is not a cure-all, and it is not a substitute for sound architecture. It is a policy enforcement point that happens to sit very close to the operating system. The value comes from its consistency. If the rules are clear and the structure is predictable, the host behaves the way you expect. Overview of the Main Linux FirewallOptions Most administrators choose between four tools when they evaluate the best Linux firewall for a given environment. The differences are not subtle, but they are also not complicated once you look at how each one expects you to work. The goal here is not to walk through syntax or rule construction. It is to explain how each option approaches policy control so you can match the tool to the way your team operates. UFW: A Simple Firewall Option for Beginners UFW was designed for people who want to express intent without wrestling with low-level primitives. It offers a clean, high-level interface that makes sense in smaller environments, especially when the rule set is short and the workflow is predictable. Many administrators use it on laptops, developer machines, and lightweight servers because it removes friction without hiding too much. Anyone who needs a quick refresher on its behavior can use the UFW basics guide available at linuxsecurity.com. iptables: A Legacy Linux Firewall Framework iptables still appears everywhere. Long-running fleets, older distributions, and embedded systems rely on it because it has been the default for so long. It remains a stable choice when compatibility matters more than modernization. The tradeoff is that it mirrors the structure of the underlying packet filter, so it expects you to understand how traffic moves through those chains. If you want to revisit the fundamentals behind that model, our article on packet filtering basics gives helpful context without diving into deep engineering detail. nftables: The Modern Successor for Linux Firewall Management nftables replaces several older components and introduces a cleaner rule model that better reflects how administrators think about policy. It reduces duplication, organizes logic more efficiently, and ties long-term maintenance to a single, consistent framework. Teams planning future deployments tend to favor it because it avoids the pitfalls that accumulated around legacy tooling. Beforeworking with it, many administrators find it useful to review material on rule structure and ordering. firewalld: A Zone-Based Firewall Manager for Dynamic Environments firewalld takes a service-oriented approach. Instead of writing rules directly, you work with zones and service definitions that can shift with the system. This approach fits hosts that change roles or sit in environments where network conditions vary. It also makes sense in data centers or virtualized platforms where interfaces and services do not stay static. When something behaves unexpectedly, troubleshooting often comes down to verifying which zone is active and how the service definitions map to the rule backend. Those who want to revisit common diagnostic steps can look at the firewall troubleshooting steps overview at linuxsecurity.com for context. Strengths and Weaknesses of Firewalls for Beginners When people compare the types of firewalls on Linux, they often get lost in syntax, even though the real differences show up in how these tools frame policy. Each one sets its own expectations for structure, clarity, and scale. Looking at those factors side by side helps you see why a tool may feel intuitive in one setting and awkward in another. Some firewalls focus on abstraction. UFW falls into that category. It presents intent through a simplified interface, which works well when your rules are short and the system does not change much. The advantage is speed. You can express policy without parsing long tables of chains or translating a decision into multiple rule entries. The tradeoff is that you have limited visibility into the underlying logic, which can matter later if you begin to stack more complex conditions. Others favor granularity. iptables is the clearest example. It exposes the structure of the packet filter directly, so your policy ends up expressed in a sequence of tightly scoped rules. This approach appeals to administrators who want to see every step of the decision path. It also scales in ways simpleinterfaces cannot, but it carries a cost. The more detailed the policy becomes, the harder it is to follow the flow unless you are already comfortable with the underlying model. Tools like nftables and firewalld sit between these extremes. nftables streamlines logic and reduces duplication, which helps when rulesets grow or when multiple teams maintain the same policy. firewalld organizes behavior through zones and services, which works well in changing environments where interfaces and requirements shift. Both tools reward administrators who value organization and long-term maintainability over step-by-step detail. Understanding these differences helps you set realistic expectations. A tool that feels accessible today might become restrictive when your environment changes. Another that seems complex at first might be the only option that handles the scale or clarity you need later. The next section gets into how to evaluate those factors when choosing the best Linux firewall for your situation. How Do I Choose the Right Linux Firewall? Selecting the best Linux firewall is less about feature lists and more about how each tool fits the way you already manage systems. Administrators rarely choose a firewall in isolation. They choose it in the context of their workflow, their operational habits, and the level of complexity they are willing to support long term. One of the simplest ways to narrow the field is to look at your comfort level with networking concepts. If you want high-level control without interpreting detailed rule structures, UFW usually feels natural. It gives you fast results and predictable behavior, which is why many teams use it on smaller servers and individual workstations. Your environment matters just as much. Servers with a static role often do fine with straightforward tools. Systems that shift between networks or services benefit from the zone-based model firewalld uses, since it adapts more easily when interfaces move or when new roles come online. In largerdeployments, especially those that span multiple hosts, nftables tends to stand out because it organizes policy in a cleaner way and avoids the duplication that creeps in with legacy tooling. Some administrators need more than simple allow or deny decisions. They want consistent outbound control or detailed filtering of egress traffic. If that is part of your threat model, you will want to factor it into your choice. If you want a clear explanation of how outbound control works, you can reference the Egress filtering basics guide at linuxsecurity.com. Maintenance is another practical consideration. Policies tend to grow over time. A ruleset that starts small can evolve into something dense after a few service additions or operational changes. If your team expects to revisit the firewall regularly, choose a tool that keeps rules readable as they expand. nftables and firewalld often age better in that respect, although the right choice still depends on how your team writes and reviews policy. No single tool solves every use case. The decision comes down to how much detail you want to manage, how often the system changes, and how you plan to maintain the rules over the life of the host. The goal is not to memorize internal mechanics. It is to choose the firewall that aligns with your environment and reduces the friction your team deals with day to day. Common Beginner Misunderstandings When Choosing Among Types of Firewalls People run into the same predictable issues when they compare the types of firewalls on Linux. Most of these misunderstandings come from expectations shaped by older deployments, half-remembered tutorials, or outdated advice. The most common patterns include: Thinking iptables is obsolete. nftables replaces several legacy components, but iptables is still everywhere. Teams keep it because the behavior is predictable and because migrations take time. Treating it as deprecated creates the wrong assumptions when you’re supporting long-running hosts. Assuming UFW isinsecure because it simplifies the interface. Its security posture comes from the policies you apply, not the level of abstraction. UFW remains popular on workstations and smaller servers because it reduces configuration drift without weakening control. Believing firewalld is only for servers or large deployments. Its zone-based structure helps on any host where interfaces or roles change. Many unexpected decisions come from the rule order rather than the tool itself. If you want a clearer picture of how ordering affects outcomes, see our firewall rule ordering basics guide. All of these misunderstandings share a pattern. They focus on the surface of the tool instead of the policy beneath it. Once the interaction between rules feels familiar, the differences among these firewalls become easier to interpret. Our Final Thoughts on What Matters Most When You Compare Linux Firewalls Most firewall decisions get easier once the core ideas feel familiar. All of the major Linux tools work from the same principles. They inspect traffic, compare it against the rules you define, and enforce a policy that reflects your expectations. The structure changes from tool to tool, but the intent stays constant. A clear understanding of those fundamentals is usually what prevents confusion later, especially when a system behaves in a way that does not match your first impression. If you want a closer look at how Linux evaluates traffic, you can explore our article on Linux firewall basics . This guide keeps the focus on selection rather than mechanics, which is usually the part that stalls teams. Once you know the boundaries you need to enforce, the rest of the work comes down to picking a tool that represents those policies in a way you can maintain. Once you know how your environment handles traffic, the choice between UFW, iptables, nftables, and firewalld turns into a practical evaluation instead of a theoretical one. Each option fits a particular workflow and a particular tolerance forcomplexity. That is why most teams refine their choice as their infrastructure grows. What works for a single host may not scale in a multi-tenant setup, and what feels heavy on a workstation might be exactly what you want on a production system. . Linux offers several mature options, each shaped by different assumptions about how administrators w. choosing, firewall, linux, looks, simple, until, match, environment. . Anthony Pell
This Cisco whitepaper discusses the TCP/IP architecture and provides a basic reference model that explains TCP/IP terminology and describes the fundamental concepts underlying the TCP/IP protocol suite. Great document. . . This Cisco whitepaper discusses the TCP/IP architecture and provides a basic reference model that ex. cisco, whitepaper, discusses, tcp/ip, architecture, provides, basic, reference, model. . Anthony Pell
Wireguard is an open-source cross-platform VPN implementation that uses state of the art cryptography and provides faster, simpler and more functional VPN tunneling than the IPSec and OpenVPN protocols. Learn how to set up Wireguard on CentOS 8 in this HowtoForge tutorial. . Wireguard is an open-source cross-platform VPN implementation that uses state of the art cryptography. It is faster, simpler and more functional than IPSec and OpenVPN protocols. It is designed as a general-purpose VPN to run on embedded interfaces and supercomputers and runs on Linux, Windows, macOS, iOS, Android, BSD and various other platforms. This tutorial will cover how to install Wireguard VPN on a CentOS 8 based server and to connect to it using a Linux(CentOS/Fedora/Ubuntu) client. . Learn the process to configure Wireguard VPN on CentOS 8 with straightforward instructions for enhanced online security.. Wireguard VPN, CentOS 8 Setup, Secure Tunneling, Open Source Networking. . Brittany Day
VTun provides an easy and simpler way to create virtual tunnels between TCP/IP networks with traffic shaping, compression and encryption. It supports IP, PPP, SLIP, Ethernet and other tunnel types.. The link for this article located at VTun is no longer available. . The link for this article located at VTun is no longer available.. provides, simpler, create, virtual, tunnels, between, tcp/ip, networks, traffic. . Anthony Pell
Aim of this document to give some examples for setting up IPsec between different operating systems. Tested platforms were OpenBSD 3.3, GNU/Linux using Super-FreeS/WAN 1.99_kb4, Kame/NetBSD 1.6.1, Windows 2000 and PGPNet on WindowsME.. . Configuring IPsec on Linux, OpenBSD, and Kame/*BSD requires knowledge of each OS's specific tools. These examples provide foundational setup for interoperability.. IPsec Configurations, Linux OpenBSD Interoperability, Secure Networking Setups. . Anthony Pell
This HOWTO discusses how to configure IPSec for Linux and connecting to it using the PGPNet VPN client.. . This HOWTO discusses how to configure IPSec for Linux and connecting to it using the PGPNet VPN clie. howto, discusses, configure, ipsec, linux, connecting, using, pgpnet. . Anthony Pell
This document is intended to be a primer on how to get IPsec on FreeBSD up and running, interoperating both with another FreeBSD (or NetBSD or any other KAME-derived stack) machine, and a Windows 2000 machine.. . This document is intended to be a primer on how to get IPsec on FreeBSD up and running, interoperati. document, intended, primer, ipsec, freebsd, running, interoperati. . Anthony Pell
Get the latest Linux and open source security news straight to your inbox.