Description:
Linux provides multiple firewall solutions to control inbound and outbound network traffic: UFW (Uncomplicated Firewall) is a user-friendly front-end for IPTables, designed for simplicity on Ubuntu systems. Firewalld is a dynamic firewall manager with zone-based network control, used on RHEL/CentOS-based systems. IPTables is the traditional Linux packet filtering framework that provides granular control over network traffic. NFTables is the modern successor to IPTables with improved performance and cleaner syntax. At least one firewall must be active to control network traffic and protect the device from unauthorized access.
Rationale:
Without an active firewall, a Linux device accepts all incoming network connections, significantly increasing its attack surface. Enabling a firewall blocks unauthorized inbound connections, prevents port scanning exposure, and reduces the risk of network-based exploits. The compliance tool checks for at least one active firewall solution (UFW, Firewalld, IPTables, or NFTables) to ensure the device has basic network traffic control in place.
Impact:
Blocks unauthorized inbound network connections to the device.
Reduces the attack surface by filtering unwanted network traffic.
Reduces exposure to port scanning and network reconnaissance by external attackers.
UFW provides the simplest setup and is recommended for Ubuntu desktop/server systems.
Some applications may require firewall rules to allow their network connections.
Only one primary firewall manager should be active at a time to avoid rule conflicts.
Default Value:
UFW is installed but DISABLED by default on Ubuntu. Firewalld, IPTables, and NFTables must be installed and enabled manually. The compliance tool checks for any active firewall — enabling UFW alone is sufficient to become compliant on Ubuntu systems.
Pre-Requisite:
Ubuntu 20.04 LTS or later (or equivalent Linux distribution).
Administrator (sudo) privileges on the device.
Only one firewall manager should be active at a time — do not enable UFW, Firewalld, and IPTables simultaneously.
Remediation:
Why are there 4 options?
Ubuntu includes UFW (Uncomplicated Firewall), but it is turned off by default, so the device has no active firewall until one is enabled. For most users, UFW is the right choice — it is simple, lightweight, and built for Ubuntu.
The other options (Firewalld, IPTables, NFTables) are listed because the compliance tool accepts any of them. Use ONLY ONE option. If you choose Option B, C or D, the steps start by turning UFW off so the two do not conflict.
Test Plan:
Pre-Implementation Check (run before making any changes)
Check whether any firewall is currently active:
Expected on a non-compliant device: “Status: inactive” from UFW, and inactive for firewalld and nftables. If any of these shows active, a firewall is already enabled and no changes are needed.
Post-Implementation Check (run after completing the Implementation Steps)
Run the check for the option you implemented:
If you used Option A (UFW):
Expected output: Status: active, and Default: deny (incoming), allow (outgoing)
If you used Option B (Firewalld):
Expected output: running
If you used Option C (IPTables):
Expected: both commands list the ACCEPT rules followed by a final DROP rule in the INPUT chain.
If you used Option D (NFTables):
Expected: the ruleset shows “policy drop” on the input chain, and the service shows Active: active (exited).
Implementation Steps:
Option A: Enable UFW Firewall (Recommended for Ubuntu)
UFW is the simplest option for Ubuntu. Run the following commands in Terminal:
Install UFW (if not already installed):
Allow SSH (only needed if this device is accessed remotely over SSH — otherwise skip this command), then enable UFW:
Type "y" when prompted to proceed. Enable logging:
Option B: Enable Firewalld
Turn off UFW first (only one firewall should be active):
Install and enable Firewalld:
Option C: Enable IPTables
Turn off UFW first (only one firewall should be active):
Install and configure IPTables with basic rules:
If asked “Save current IPv4 rules?” or “Save current IPv6 rules?”, select Yes.
Apply the same protection to IPv6 traffic (otherwise IPv6 stays unfiltered):
Save the rules so they stay in place after a reboot:
Option D: Enable NFTables
Turn off UFW first (only one firewall should be active):
Install and enable NFTables:
Important: NFTables starts with an empty ruleset that allows all traffic, so rules must be added for it to protect the device. Open the configuration file:
Replace the entire contents of the file with the following, then save and exit (Ctrl+O, Enter, Ctrl+X). Remove the line “tcp dport 22 accept” if the device is not accessed over SSH:
Apply the rules:
Backout Plan:
Step 1: Disable UFW (if UFW was enabled)
Run the following command to disable UFW:
Step 2: Disable Firewalld (if Firewalld was enabled)
Run the following commands:
Step 3: Remove IPTables rules (if IPTables was configured)
Remove all IPTables rules:
Save the empty rules so they do not come back after a reboot:
Step 4: Disable NFTables (if NFTables was enabled)
Run the following commands to stop and disable NFTables:
Note: Disabling the firewall exposes the device to all inbound network traffic. Add specific firewall exceptions instead of disabling entirely where possible.
Note:
Only one firewall manager should be active at a time — running UFW and Firewalld simultaneously can cause rule conflicts. UFW is the recommended option for Ubuntu desktop and server systems due to its simplicity. Always allow SSH (port 22) before enabling the firewall to avoid locking yourself out of a remote system. Test firewall rules carefully in a non-production environment before applying to production systems.