Firewalls (nftables & firewalld)

On a fresh openSUSE install the firewall is already blocking almost all outgoing traffic, and the built-in YaST firewall module is missing your Ethernet interface. What is the recommended way to fix rules?

You want to run a custom service on port 900 versus port 2000. Why does one of those choices require root and the other does not?

Where does a Linux system map friendly names like ssh, http, and https to their numeric IP port numbers?

A colleague says every IP service confirms receipt of packets. Which common protocols contradict that, and why does it matter for firewall rules?

You want a quick list of which ports your local machine is actually listening on, including the owning process. Which netstat invocation gives that?

You need to find which process is holding a specific network port, say port 22. Which command targets that directly?

From an outside host you want to discover which services and OS a server is exposing. Which tool and flags do that, and what does each flag add?

Against which servers is it legally and ethically safe to run an nmap port scan, and why does the target matter?

Beyond adding a firewall, what layered measures actually harden the network services running on a Linux host?

Which two files does the TCP wrapper library use to control host-based access, and which one wins when both could apply?

A host is listed in neither hosts.allow nor hosts.deny. Many admins assume that means blocked — what actually happens, and how do you build a secure setup?

You edited hosts.allow but the rules seem ignored for a given daemon. How do you verify that daemon even uses the TCP wrapper library?

In a typical Apache setup one process runs as root while the rest run as www-data. Why the split?

What does chroot rootdir command achieve for a network service, and what extra condition is required for it to actually contain the process?

A home user asks whether a local Linux firewall is really necessary behind their router. When does the router's protection stop being enough?

How does nftables relate to the older netfilter/iptables system, and roughly when did it take over as default?

You're writing a firewall by hand today. Why is reaching for the familiar iptables command the wrong move?

Predefined graphical firewall tools are marketed as convenient. What is the recurring downside, and how does it typically backfire for beginners?

What is FirewallD's headline advantage over the older static packet-filter approach?

What is a zone in FirewallD, and how does it relate to network interfaces?

Both the FirewallD drop and block zones refuse all traffic. What is the practical difference between them?

You ran firewall-cmd to open a port, it worked, but after a reboot the rule is gone. What did you miss?

With firewall-cmd, how do you open a service or port in a zone, and how do you inspect what's currently allowed?

What firewall front-end ships with Ubuntu, what is it built on, and what happens the moment you enable it with its default policy?

You install Apache and run ufw app list — the Apache profile appears. What state is that profile actually in for firewall purposes?

In nftables terminology, how do rules, chains, and tables nest — and how does this differ from iptables?

Which nftables protocol family do you choose when a single rule set should apply to both IPv4 and IPv6, and what are the alternatives?

nftables chains attach to kernel hooks rather than fixed built-in chains. Which hooks are available, in packet-flow order?

The old netfilter world had separate iptables, arptables, and ebtables commands. What changed under nftables, and does it use a different kernel mechanism?

How do you dump the entire nftables ruleset, save it, and later restore it verbatim?

An nft chain has two chains attached to the same hook with priority values 0 and 10. Which runs first?

What are the three ways to feed rules to nft, and what makes a rule file self-executing?

Beyond accept and drop, what other actions can an nft rule take, and which of them still lets later rules run?

Which nft match keywords select packets by port versus by IP address, and how do you express a range or a negation?

What does ct state match in an nftables rule, and which states can you test?

You harden an IPv6 server by dropping all ICMP the way you would on IPv4. Why does that break things?

You add limit rate 5/minute accept for pings, expecting extra pings to be blocked. Why might a sustained ping still get through?

What is the standard skeleton of an nft input filter that protects a simple web server?

In an nft filter chain, what is the default policy if you don't set one, and how do you make the chain deny-by-default?

You're testing a new firewall over SSH on a remote server. What's the safe way to avoid permanently locking yourself out?

Samba shares stay invisible on Fedora, SUSE, or RHEL until you open the firewall. Which ports must you open, and how wide?

Beyond its payload, what four pieces of addressing information does every IP packet carry, and why do firewalls care?

Why does listing the ports a machine is actively monitoring tell you its attack surface?

How is a single line in /etc/hosts.allow structured, and how do you write an IPv6 address in it?

Debian ships no firewall and no firewall config tool of its own. So what does the Debian Wiki recommend you install?

What starts FirewallD, where does it keep its configuration, and what actually enforces the rules underneath?

On a router's internet-facing interface you'd pick the external FirewallD zone. What does that zone do that home and public don't?

Fedora assigns interfaces to FedoraWorkstation or FedoraServer. How do those two zones differ, and which zones can you never edit?

RHEL puts every interface in the public zone by default. How do you make one interface use a different zone permanently?

firewall-config offers no button to switch the firewall off. So how do you actually disable FirewallD?

Which firewall-cmd queries tell you whether FirewallD is running and how interfaces map to zones?

You run firewall-cmd --change-interface to move an interface into a zone, but the change doesn't stick. What overrides it?

Does ufw handle IPv6 out of the box, and where do its rules actually live on disk?

Which nft commands list the tables that exist and reveal the chains and rules inside one of them?

You want your nft ruleset to load automatically at every boot. Which service reads it, and from which file?

In this book's usage, what specifically does the term firewall refer to?

A distribution enables a firewall at install time. Which direction of traffic does it block, and what must you do to host a service?

When an IP packet reaches the kernel, what choices does the kernel have, and where do firewall rules fit in?

In an nft rule, how do you match all ICMP or ICMPv6 traffic, versus just one message type like echo-request?

Which nft match keywords select a packet by the interface it came in on or is going out on?

Besides accept and drop, nft has counter and log. Why are these two special in how a packet keeps flowing?