Post #671557

2026-03-14 10:08 UTC

You just provisioned a fresh Linux server. Within minutes, the SSH brute-force bots will arrive. There are too many ways to build a firewall in Linux. I wrote a practical guide to the four major tools: iptables, nftables, firewalld, and ufw, including their mental models and deployable configs. Also includes a deep dive into the &quot;Docker Trap&quot; (why Docker silently bypasses your default-deny rules) and how to fix it. (And yes, I still spend the intro and conclusion reminding everyone that FreeBSD&#39;s PF is the undisputed king of packet filtering. Let&#39;s argue in the replies.) Read it here: https://blog.hofstede.it/linux-firewalls-how-to-actually-secure-a-cloud-server-iptables-nftables-firewalld-ufw/ #Linux #Sysadmin #DevOps #Security #Netfilter #Docker #Networking

Replies (11)

@npub1600yr4qg5vcfp7svf6ysj0008tn7aphnu0gjs6lw5hjn74n0laasjx889v@momostr.pink 2026-03-14 10:34

You might be interested in crowdsec. Joining that your server becomes a honeypot for this kinda bruteforce attack. If they fail a few times their IP gets submitted by your server and banned on all of them. Gets you an automatic banlist before they even reach your server.

Open ##1167866
@nathanael@dalliard.ch 2026-03-14 20:19

why?

Open ##1167869
@decapitae@mastodon.social 2026-03-14 11:39

@Larvitz FOSS FTW!

Open ##1234100
@infosec812@foojay.social 2026-03-14 12:24

@Larvitz I went a different direction. I have #OpenVPN on my servers and only allow SSH from OpenVPN connected hosts. I originally started with #WireGuard, but too many public Wifi block WireGuard.

Open ##1234101
@asynchronaut@fosstodon.org 2026-03-14 15:29

@Larvitz Could mention bpfilter: https://github.com/facebook/bpfilter

Open ##1234102
@yojimbo@masto.hackers.town 2026-03-14 23:22

@Larvitz `ssh` should not be facing the Internet these days for the vast majority of users, even though by default it usually makes secure choices (like, no root user and keys instead of passwords). Your VPS should come with console access, which can be used for initial configuration and emergency access. You can then choose to set up management access via some separate network, probably a VPN.

Open ##1234105
@BalooUriza@social.tulsa.ok.us 2026-03-15 06:32

@Larvitz "There are too many ways to build a firewall in Linux."

Open ##1234108
@lbehm@chaos.social 2026-03-16 09:34

@Larvitz I think your explanation of the docker behavior is incorrect. Port publishing using `-p` starts a docker-proxy userspace program on the host that listens on the specified port (effecting the input chain) and forwards the traffic to the container (using the output chain). Using forwarding (with prerouting nat) instead could be faster. The docker-proxy behavior enables port configurations like `127.0.0.1:80:8080`.

Open ##1234109
@lbehm@chaos.social 2026-03-16 09:50

@Larvitz Thank you for the nftables set / update examples!

Open ##1234111
@subnetspider@mastodon.bsd.cafe 2026-03-17 16:27

@Larvitz Pretty interesting read, as I've never set up the firewall on a Linux host. And I have to admit, firewalld looks pretty neat. 😁

Open ##1234118
@Ntropic@chaos.social 2026-03-18 09:26

@Larvitz I don't even know if I should worry about this.

Open ##1234126