Linux · Privacy & Security

Configure the firewall and harden basic system security

Most desktop distros ship a firewall tool that isn't enabled by default out of the box on some systems — Ubuntu-based distros use `ufw` (Uncomplicated Firewall), Fedora and most RHEL-based systems use `firewalld`, and both are front-ends over the same underlying kernel netfilter/nftables rules.

What you should know

  • Ubuntu/Debian: `sudo ufw enable` turns it on with a default deny-incoming/allow-outgoing policy; `sudo ufw status verbose` shows current rules; `sudo ufw allow <port>` opens a specific port.
  • Fedora/RHEL-based: `sudo systemctl enable --now firewalld`; manage zones and rules with `sudo firewall-cmd --list-all` and `sudo firewall-cmd --add-service=<service> --permanent`.
  • GUI options exist too — `gufw` for ufw, and firewalld has a GTK config tool (`firewall-config`) for a visual view of zones and rules.
  • Check what's actually listening on the network with `sudo ss -tulpn` — useful for confirming a firewall rule is blocking (or not blocking) the right thing.

Opening a port for one app (e.g. file sharing, a local dev server) means it's reachable from your whole local network, not just the app that needed it — narrow the rule to a specific source IP/subnet when possible instead of a blanket allow.

Why it matters

A default-open firewall configuration (or none running at all) is one of the more overlooked gaps on a fresh Linux desktop install — most distros are reasonably secure by default otherwise, but leaving the firewall off removes one meaningful layer of protection on public or untrusted networks.

Best practices

  • Enable the firewall by default and only open the specific ports/services you actually use, rather than disabling it for convenience.
  • Use your desktop environment's network profile (public vs. home/trusted) if it offers one — some auto-adjust firewall zones based on the connected network.
  • Keep SSH access restricted to key-based auth if you enable a remote SSH server, and consider changing it off the default port 22 as a light deterrent (not a substitute for real hardening).

Common problems and fixes

Local network file sharing or a dev server isn't reachable from another device
Check `sudo ufw status` / `sudo firewall-cmd --list-all` for the required port or service, and add an allow rule rather than disabling the firewall entirely.
Firewall rules don't survive a reboot
Rules added with `firewall-cmd` need `--permanent` (and a `--reload`) to persist — without it, they only apply to the current session.

Tips and tricks

  • `sudo ufw app list` shows pre-defined application profiles (like OpenSSH) so you can allow a known service by name instead of guessing the port number.

Frequently asked questions

Do I need antivirus software on Linux?

Not for the same reasons as Windows — Linux desktop malware is far less common — but a firewall, prompt updates, and caution about what you install still matter, especially if you share files with Windows/macOS users (where a Linux-hosted antivirus like ClamAV can help scan for malware relevant to them).