Linux Firewall Ssl

Firewall & SSL Management

Distro support

Two-family skill. UFW is the Debian/Ubuntu firewall; the RHEL family (Fedora, RHEL, CentOS Stream, Rocky, Alma, Oracle) uses firewalld — a zone-based model, not a flat allow-list. certbot works on both; only install and the renew timer differ. The body below uses UFW/Debian; full RHEL detail is in references/firewalld-reference.md.

Both UFW and firewalld emit nftables rules through the kernel's nf_tables subsystem — they are front-ends over the same backend. Drop to raw nft / iptables only for rules a front-end can't express (custom NAT, port forwarding), to read what a front-end produced, or on hosts managed directly. Full detail in references/nftables-and-iptables.md.

In sk-* scripts use the firewall_allow helper from common.sh, which targets whichever firewall is active. See references/firewalld-reference.md and docs/multi-distro/plan.md.

Use when

• Managing UFW rules on a server.
• Issuing, renewing, or debugging TLS certificates with certbot.
• Verifying HTTPS posture, renewal state, or TLS config for a site.

Do not use when

• The task is broader web stack tuning or 502 troubleshooting; use linux-webstack.
• The task is user access or SSH key management; use linux-access-control.

Required Inputs

Capability Contract

Read/search inspection may be read-only. Firewall mutation, package installation, certificate issuance, web-server edits, and reloads require explicit change authority and root access. Preserve an independent management session before default-deny or SSH rule changes.

Degraded Mode

Without DNS, network, root, Certbot, or a second management session, report verified local state and label public reachability, issuance, renewal, or lockout safety not assessed. Never interpret an unavailable probe as success.

Decision Rules

Workflow

1. Detect distro, active firewall front end, live rules, listening sockets, certificate inventory, and renewal timer.
2. Compare requested exposure with actual application listeners and DNS; stop on an unexplained mismatch.
3. Choose the narrow rule, zone, or certificate action from the decision table and establish rollback access.
4. Syntax-check configuration or dry-run renewal before applying; recover by restoring the saved rules/config on failure.
5. Apply the authorised change and reload only the owning service.
6. Verify local rules, external reachability where available, certificate chain/names/expiry, and renewal dry run.

Outputs

Evidence Produced

Quality Standards

• Rules expose only named services to approved sources or zones.
• Management access remains independently verified during policy changes.
• Certificate identity, chain, expiry, and automated renewal are checked.
• Failed external checks remain failures or unassessed, never passes.

Anti-Patterns

• Opening a broad port range for convenience. Fix: map each listener to an approved service.
• Mixing raw nftables rules with an active UFW/firewalld owner. Fix: use one control plane.
• Enabling default-deny over the only SSH session. Fix: preserve and test a second session.
• Reissuing before diagnosing DNS or ACME failure. Fix: validate prerequisites and use a dry run.
• Treating a local HTTPS response as proof of public reachability. Fix: use an external probe or mark it unassessed.
• Storing private keys or credentials in evidence. Fix: record paths, permissions, and fingerprints only.

Worked Example

A Rocky host must expose HTTPS publicly and SSH only from 198.51.100.0/24. Confirm public is the interface zone, preserve a second SSH session, add https and the source-limited SSH rule permanently, reload, then verify both runtime and permanent rules before running certbot renew --dry-run.

References

• references/ufw-reference.md
• references/firewalld-reference.md
• references/nftables-and-iptables.md
• references/certbot-reference.md
• references/ssl-config.md

This skill is self-contained. Every command below is a standard tool on its family — ufw + certbot on Debian/Ubuntu, firewall-cmd (firewalld) + certbot on the RHEL family (see references/firewalld-reference.md). The sk-* scripts in the Optional fast path section are convenience wrappers — never required.

UFW Firewall

sudo ufw status verbose                 # current rules
sudo ufw status numbered                # numbered for easy deletion

# Standard web server rule set:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp && sudo ufw allow 80/tcp && sudo ufw allow 443/tcp
sudo ufw enable

# Add a rule
sudo ufw allow <port>/tcp
sudo ufw allow from <ip> to any port 22   # restrict SSH to trusted IP

# Remove a rule
sudo ufw status numbered
sudo ufw delete <number>

# Rate limiting (brute-force protection)
sudo ufw limit 22/tcp

# Logging
sudo ufw logging on
sudo tail -f /var/log/ufw.log

SSL Certificates (Certbot)

# Issue new cert (nginx plugin — modifies config automatically)
sudo certbot --nginx -d example.com
sudo certbot --nginx -d example.com -d www.example.com

# Check all cert expiry
sudo certbot certificates

# Test auto-renewal
sudo certbot renew --dry-run

# Force renew
sudo certbot renew --force-renewal

# Add domain to existing cert
sudo certbot --nginx --expand -d existing.com -d new.com

# Check renewal timer
sudo systemctl status certbot.timer

Troubleshoot Renewal Failure

Every HTTP server block needs this for ACME challenge:

location /.well-known/acme-challenge/ { root /var/www/html; }

# Verify all vhosts have it:
sudo grep -r "acme-challenge" /etc/nginx/sites-enabled/

# Test challenge path is reachable:
curl -s http://example.com/.well-known/acme-challenge/test
# Should return 404, not connection refused

# Debug renewal:
sudo certbot renew --dry-run --debug
sudo journalctl -u certbot --no-pager | tail -30

Full SSL parameters and cipher config: references/ssl-config.md

Raw netfilter (nftables / iptables)

UFW and firewalld are the recommended front-ends; both compile down to nftables. Manage rules through the front-end on a normal host. Drop to raw nft/iptables only for what a front-end can't express (custom NAT, port forwarding), to read what a front-end produced, or on directly-managed hosts. Do not mix hand-written rules with an active front-end — it owns its tables and overwrites them on reload.

# View — works regardless of front-end (shows ufw/firewalld output too)
sudo nft list ruleset
sudo nft -a list chain inet filter input    # -a = rule handles (needed to delete)
sudo iptables -S                             # legacy command surface (nft shim)

# A safe default-deny inet/filter ruleset (loopback + established + SSH + web).
# Load atomically; `flush ruleset` makes it idempotent:
sudo nft -c -f /etc/nftables.conf            # -c = syntax check only (dry run)
sudo nft -f /etc/nftables.conf               # apply (replaces live ruleset)

# Delete one rule by handle; flush a chain
sudo nft delete rule inet filter input handle 7
sudo nft flush chain inet filter input

# NAT / masquerade / port forward
sudo nft add rule ip nat postrouting oifname "eth0" masquerade
sudo nft add rule ip nat prerouting tcp dport 80 dnat to 192.0.2.10:8080

# Persist: Debian → /etc/nftables.conf, RHEL → /etc/sysconfig/nftables.conf
sudo sh -c 'nft list ruleset > /etc/nftables.conf' && sudo systemctl enable --now nftables

# IP routing table
ip route show
sudo ip route add 10.20.0.0/16 via 192.0.2.1 dev eth0

Default-deny on a remote host can lock you out: always keep an accept rule for SSH and for ct state established,related above the drop, and test in a second session before disconnecting.

Full detail — iptables vs nftables, NAT, sets/maps, the front-end backend relationship, iptables-save/netfilter-persistent, migration, and ip route persistence — is in references/nftables-and-iptables.md.

Optional fast path (when sk-* scripts are installed)

Running sudo install-skills-bin linux-firewall-ssl installs:

These are optional wrappers. The ufw and certbot commands above are the source of truth.

Scripts

This skill installs the following scripts to /usr/local/bin/. To install:

sudo install-skills-bin linux-firewall-ssl