iptables vs nftables vs ufw
All three tools manipulate the same Linux kernel netfilter subsystem. iptables is the classic interface, still ubiquitous on older systems and in many Docker environments. nftables replaces it on modern distros (Debian 10+, Ubuntu 20.04+, RHEL 8+) with a cleaner syntax and better performance for complex rulesets. ufw ("Uncomplicated Firewall") is a high-level wrapper around iptables designed for simpler server setups; it doesn't expose connection tracking states or interfaces in the same way.
Rule order matters
Firewall rules are evaluated top-to-bottom and the first matching rule wins. Always add more-specific rules before catch-all rules. A common mistake is adding an ACCEPT rule for SSH after a default-DROP rule for INPUT, the ACCEPT never fires because the DROP already caught the packet.
Making rules persistent
iptables rules are in-memory only and disappear on reboot. Use iptables-save > /etc/iptables/rules.v4 and iptables-restore (via the iptables-persistent package on Debian/Ubuntu) to survive reboots. For nftables, use nft list ruleset > /etc/nftables.conf and ensure the nftables service is enabled. For ufw, rules persist automatically after ufw enable.
State tracking
The ESTABLISHED,RELATED state match is the linchpin of stateful firewalling: it allows return traffic for connections you initiated, without opening the reverse rule. A minimal secure INPUT policy is: DROP everything, ACCEPT loopback, ACCEPT ESTABLISHED+RELATED, then ACCEPT only the specific services you want (e.g. port 22 for SSH, 443 for HTTPS).