📋 Firewall Cheat Sheet

UFW vs firewalld Command Comparison

Operation	UFW	firewalld
Enable/Disable	ufw enable/disable	systemctl start/stop firewalld
View status	ufw status	firewall-cmd --state
Allow port	ufw allow 80/tcp	firewall-cmd --add-port=80/tcp
Deny port	ufw deny 3306/tcp	firewall-cmd --add-port=3306/tcp --zone=drop
Allow service	ufw allow ssh	firewall-cmd --add-service=ssh
Rate limit	ufw limit 22/tcp	--add-rich-rule='...limit value="5/m"...'
View rules	ufw status numbered	firewall-cmd --list-all
Delete rule	ufw delete 3	firewall-cmd --remove-port=80/tcp
Persistent	Automatic (ufw rules are persistent by default)	--permanent + --reload
Logging	ufw logging medium	firewall-cmd --set-log-denied=all

Firewall Selection Guide

Scenario	Recommendation	Reason
Ubuntu Desktop	UFW	Installed by default, easy to use
Ubuntu Server	UFW or nftables	UFW is sufficient; use nftables for complex scenarios
CentOS/RHEL 7	firewalld	Installed by default, supports dynamic rules
CentOS/RHEL 8+	nftables	firewalld backend has switched to nftables
Docker Host	nftables + DOCKER-USER	Docker bypasses UFW/firewalld
High concurrency/large scale	nftables	Set matching O(1), best performance

💡 Tip: 💡 Ultimate advice: Regardless of which tool you use, understanding the underlying packet filtering principles (iptables chains/tables/matches/targets) is the core. Tools change, principles don't. Once you master iptables, switching to any other tool only requires learning the syntax.