UFW Firewall, IPTables, Port Management, Connectivity, Troubleshooting & Real DevOps Scenarios (Full Guide)

Today was all about understanding how VM-level firewalls work using UFW (Uncomplicated Firewall) and why it’s preferred over traditional IPTables.
I also performed a hands-on practical using Java + Maven, tested port access, and learned multiple real-world troubleshooting techniques.

Let’s break down everything I learned 👇

---

🔐 1️⃣ Why Do We Need UFW When We Already Have Security Groups?

Security Groups (AWS/GCP/Azure) control firewall rules at the network level.

But inside the VM, we still need internal firewall protection.

🔸 Traditional Approach → IPTables

While powerful, IPTables is complex:

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Not beginner-friendly. Hard to remember. Error-prone.

🔸 Modern Approach → UFW

UFW = Human-friendly wrapper over IPTables

sudo ufw allow 22

Much cleaner, easier, and safe for daily DevOps use.

---

🚦 2️⃣ UFW Fundamentals — Simple, Clean & Effective

✔️ Allow a port

sudo ufw allow 22

❌ Deny a port

sudo ufw deny 22

🔁 Specify direction

By default, UFW assumes incoming traffic.

To specify direction:

• Incoming:

    sudo ufw allow in 22
  

• Outgoing:

    sudo ufw deny out 443
  

---

📜 3️⃣ Default UFW Policies

These policies define VM behavior:

• Incoming: deny

• Outgoing: allow

Can be changed using:

sudo ufw default deny incoming
sudo ufw default allow outgoing

---

🧪 4️⃣ Hands-On Practical — Testing UFW With Java + Maven

I conducted a full demo to see UFW in action:

🔧 Installed:

✔️ Java
✔️ Maven

🧬 Cloned a board-game project (GitHub)

git clone <repo>

🚧 Issue: mvn package failed

Why?
Because the incoming port required by the application was blocked.

✔️ Enabled incoming traffic using UFW

sudo ufw allow <required-port>

The application started working after allowing the port.

✋ Disabled the port again

Saw UFW reject the connection immediately.

---

🚦 5️⃣ Types of Firewall Behaviors in UFW

1️⃣ Allow → Connection works normally
2️⃣ Deny → Silent timeout
3️⃣ Reject → Immediate error (host unreachable)

---

📝 6️⃣ Adding Comments to UFW Rules

Useful for teams — makes rules readable:

sudo ufw allow 80/tcp comment "http"

Delete rule:

sudo ufw delete allow 80/tcp

Allow specific IP:

sudo ufw allow proto tcp from <IP> to any port <port>

---

🔧 7️⃣ Troubleshooting Scenarios I Learned Today

These are real DevOps issues that happen daily:

---

🟥 Issue 1 — Packages not installing

Cause: Outbound rules blocked, system cannot reach the internet.

✔️ Fix: Add outbound allow rules.

---

🟧 Issue 2 — docker.io or other package says: “no installation candidate”

Two possible causes:

1. Didn’t run:

    sudo apt update
   

2. Package deprecated/unavailable in repo.

---

🟦 Issue 3 — SSH connection not working

Check if port 22 is open:

telnet <IP> 22

---

🟩 Issue 4 — Port already in use

Find the process:

sudo lsof -i :8080

---

🟪 Issue 5 — Check VM disk usage

du -sh
du -kh

---

🟨 Issue 6 — Permission problems

Add users to required groups:

sudo usermod -aG <group> <user>

---

🎯 Day 7 Takeaway

Today’s learning strengthened my understanding of:

✔️ VM-level firewalls
✔️ UFW vs IPTables
✔️ Port management
✔️ Allow / deny / reject behavior
✔️ Connectivity troubleshooting
✔️ SSH debugging
✔️ Storage checks
✔️ Permission fixes
✔️ Real DevOps debugging skills

Firewall management plays a huge role in secure application deployments, server protection, and cloud environments — and today helped me understand it with real, practical scenarios.

Looking forward to Day 8! 🚀