Topic: firewall
-
Firewalld and nftables rules for NFS, Samba, NTP, DNS and DHCP: exactly which ports to open
A reference for the exact ports these infrastructure services need — NFS4 TCP 2049, Samba TCP 445 (139 and UDP 137/138 only for NetBIOS), DNS TCP+UDP 53, DHCP UDP 67, NTP UDP 123 — with firewalld's predefined services, the equivalent nftables dport syntax, and why a UDP nmap/nc probe is a weak test compared with the real client.
-
Host firewalls compared: nftables, firewalld, ufw, Windows Defender Firewall, pf and ipfw
Listing rules, opening a port, making the change survive a reboot, and doing it without locking yourself out over SSH or RDP — the same four tasks across nftables, firewalld, ufw, Windows Defender Firewall, and the BSD pf and ipfw packet filters.
-
A minimal nftables ruleset for a single server
One inet table with an input chain that drops by default, accepts established and related traffic, loopback, the ICMP types the stack needs and the listed service ports; checked with nft -c -f before loading and loaded with a timed rollback so a mistake cannot lock you out.
-
Scoping Windows Defender Firewall rules with NetSecurity without locking out your own session
Get-NetFirewallProfile and New-NetFirewallRule manage Windows Defender Firewall from PowerShell; scoping a rule by -RemoteAddress and -Profile keeps a management port open only to the addresses and network types that need it, and testing from a second session avoids cutting off the one you're using.
-
The PF firewall on FreeBSD: testing pf.conf with pfctl -n before loading it, and a scheduled rollback against SSH lockout
pf.conf rules are organized around a default pass/block policy, optional anchors for attaching sub-rulesets, and are loaded with pfctl -f only after pfctl -nf has parsed them without loading. Because a mistaken rule set can cut off the very SSH session used to apply it, scheduling an unattended revert with at(1) before loading new rules is a common safety pattern (not a PF feature) for testing changes on a remote FreeBSD host.
Machine-readable: JSON