Linux · Systems fluency
How do Linux firewalls work and how do you configure them safely?
Short answer
A Linux firewall filters packets using netfilter hooks, configured through nftables, iptables, ufw, or firewalld. Start with a default-deny policy, allow only required traffic, and verify access before locking yourself out.
nftables is the modern kernel packet-filtering framework. iptables is the older interface that may be implemented on top of nftables. ufw and firewalld are front ends that generate rules and manage persistence.
nft list ruleset
ufw status verbose
ufw allow 22/tcp
ufw enableRules and failure modes
- Default deny inbound is a common baseline for servers
- Stateful rules allow return traffic for established connections
- Rule order matters because the first match wins
- Docker and Kubernetes can insert their own rules and bypass simple assumptions
- A remote firewall change can lock out SSH if the management path is not allowed
Test with a scheduled rollback or an out-of-band console. Apply the rule, confirm the new connection works, and only then make it persistent. Logging denied traffic helps distinguish a firewall drop from an application failure.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1What is the difference between nftables and iptables?
- 2Why does rule order matter?
- 3How do you avoid locking yourself out over SSH?
- 4How do container runtimes interact with host firewall rules?
Say it in the interview
Linux firewalls use netfilter, with nftables as the modern framework and tools like ufw or firewalld as front ends. I start from default deny, allow the required management and service ports, and verify before making rules persistent. I keep a rollback path because a remote firewall mistake can lock out SSH. A firewall complements patching rather than replacing it.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Linux mock interview and get scored feedback on depth, clarity and confidence.