All the other comments kind of suggest otherwise, but I am pretty certain that fedora comes with firewalld enabled by default.

I treat all guests on the network as potentially hostile, so I enable firewalls on all of my hosts.

I believe that Fedora’s firewall is enabled by default, but it leaves open ports 1025-65535/tcp and 1025-65535/udp.

To lock down some sane defaults:

sudo firewall-cmd --permanent --remove-port=1025-65535/tcp
sudo firewall-cmd --permanent --remove-port=1025-65535/udp
sudo firewall-cmd --reload

Verify allowed ports with:

sudo firewall-cmd --list-ports

See also:

• https://firewalld.org/
• https://docs.fedoraproject.org/en-US/quick-docs/firewalld/

PS: if you have a Steam Link, you’ll want to open these ports for connectivity:

sudo firewall-cmd --permanent --add-port=27031/udp  # steam remote play
sudo firewall-cmd --permanent --add-port=27036/udp  # steam remote play
sudo firewall-cmd --permanent --add-port=27036/tcp  # steam remote play
sudo firewall-cmd --permanent --add-port=27037/tcp  # steam remote play

Its best to have some defence in depth. Ideally you would have a firewall on your network AND your local machine. If you are running a laptop definitely have a local firewall on that as you cannot trust random networks you connect to when out and about in the world.

firewalld is sufficient, i suggest learning its CLI as it is not super complicated. ufw is ok if you are allergic to command line.

Just FYI, Fedora does come with Firewalld enabled by default; however, the Workstation spin also has all non-privileged ports exposed by default. This really shouldn’t be a problem as long as your router has a firewall, your network isn’t already compromised, and you don’t plan to put the computer on the internet as a server; however, as part of my kickstart script, I close all ports just to be safe and only expose the ones I need for certain services.

Even without any firewall you should be fine by default. Access to ports with no services listening do nothing. Firewalls are just defense-in-depth in case a service that you didn’t want to accidentally listens on a port. It may also slightly reduce kernel attack surface.

So I would say that you don’t need it. You will be fine. But if you want to be sure about what is listening on your machine then feel free to apply one.

You probably is protected by your routers firewall already. But if you want to keep it safe and use a firewall in your computer, you may install ufw or firewalld. The default config should be alright to your needs

Unless you mess around with firewall commands/settings you don’t understand firewalld should be sufficient.

That being said you might have to allow certain services at some point (openvpn) for example

Unless your computer is exposed directly to the internet, your router’s firewall should be enough. Fedora typically has SELinux and AppArmor enabled by default which should protect from something nasty executing on your machine.

Don’t execute things as root if you don’t know what it is and you should be fine.

I use portmaster on my fedora instance. I disabled blocking all from LAN and made a custom rule set to allow some devices and block all others.

Uncomplicated Firewall is easy to setup and understand. It blocks traffic and allows it. Install UFW

sudo apt install ufw

My recommended(Chris Titus)

`sudo ufw limit 22/tcp

sudo ufw allow 80/tcp

sudo ufw allow 443/tcp

sudo ufw default deny incoming

sudo ufw default allow outgoing

sudo ufw enable`

Is this enough?

“That guy” here. I don’t go “further” than setting everything up with firejail and then creating a mavclan port/connection pointing my main ip through it and then removing whatever is in my eth0 port/connection. All that with netctl.

“Does it work”? Well, whoever tries to scan my ip for open ports with nmap gets a nice and sweet “All ports are closed” message back. So eh… I’ll be fine. :^)