💡 Practical Experience

Always Allow SSH First, Then Tighten the Default Policy

Whether you use UFW or firewalld, the first step is always ufw allow 22/tcp or firewall-cmd --add-service=ssh. Only after that should you change the default policy to deny. If you do it in the wrong order, you may lock yourself out of the server.

Open Another Terminal Before ufw enable

If you enable UFW over SSH and the SSH rule is wrong, the connection may drop and you will be locked out. Open two terminals: use one to change the rules and the other to verify ufw status and confirm SSH is still allowed.

Docker and UFW/firewalld Are Parallel Tracks

Docker directly modifies iptables and can bypass UFW and firewalld. You may block port 8080 in UFW, but a Docker container publishing port 8080 can still be reachable from the outside. To control Docker-published ports, prefer the DOCKER-USER chain. Disabling Docker's iptables management is an advanced option; it affects port publishing, NAT, and container networking, so do not use it as the default approach unless you are ready to maintain those rules yourself.

Test Rules as Temporary Rules

Not sure whether a rule will affect normal service? Test it temporarily first: ufw deny 3306/tcp, then remove it with ufw delete deny 3306/tcp after testing. In firewalld, a rule without --permanent is temporary and disappears after reload or restart.

Logs Are Your Eyes During Troubleshooting

When a firewall silently drops packets, guessing is painful. The first troubleshooting step is to enable logging: ufw logging high or firewall-cmd --set-log-denied=all. Once you can see DROP records, you can identify which rule caused the problem.