Lion Cipher Lab
Set up a host firewall with UFW
- Cyber / Security Engineer
- Beginner
- ~20 min
- Free · no account required
Why it matters
Every service listening on a machine is a door someone can try to open. A host-based firewall decides, per machine, which doors are allowed and slams the rest shut — so a forgotten database port or a misconfigured service isn't quietly reachable from the network. The professional default is deny-by-default: block all incoming connections, then open only the few you actually need. UFW (the Uncomplicated Firewall) is the standard, beginner-friendly way to do exactly that on Ubuntu and Debian, and the discipline transfers straight to servers you'll defend on the job.
What you'll learn
- host-based firewalls
- UFW
- default-deny policy
- reducing attack surface
- safe remote (SSH) access
Steps in this lab
- What a host firewall is, and why default-deny
- Confirm UFW is present and check its state
- Allow SSH FIRST — so you don't lock yourself out
- Set the default policy: deny incoming, allow outgoing
- Enable the firewall
- Check the status and read what it tells you
- Test that the wall actually holds