Production Security
Linux Firewall Debugging Guide
Troubleshoot blocked Linux traffic across listening sockets, host firewalls, cloud rules and return paths without opening broad production access. This reference is written for developers who need practical validation behavior, reviewable rules and safe examples rather than copied snippets with no explanation.
Recommended workflow
| Step | Why it matters |
|---|---|
| Prove the listener | Confirm the process is bound to the expected address and port. |
| Test locally | Separate application failure from packet filtering with a loopback or host-local request. |
| Trace policy layers | Review nftables, firewalld or UFW before checking cloud security groups and network ACLs. |
| Verify both directions | Routing, state tracking and asymmetric return paths can look like an inbound block. |
Starter snippet
ss -lntup && sudo nft list rulesetReview checks
- Record the exact source, destination, protocol and port.
- Add the narrowest temporary rule with an expiry plan.
- Preserve console access before changing remote rules.
- Capture counters before and after the test.
Common mistakes
- Opening all ports to prove one service works.
- Editing multiple firewall layers at once.
- Testing a TCP service with an unrelated UDP probe.
Validation should help users correct input while protecting systems from bad data. Keep syntax checks, product policy, security review and deliverability checks separate.
Related Formalint references
Continue with Powershell Network Debugging Guide, Nginx Reverse Proxy Checklist, Application Health Check Guide.