What is Default-deny firewall?

A firewall posture that blocks all inbound connections by default and only allows the specific ports you explicitly open.

How it works

The opposite of a default-open system. You reduce your attack surface to almost nothing, then poke holes only for what you actually run. It's the foundation every other hardening step sits on.

Example

In practiceWith UFW you set 'default deny incoming', allow only SSH, and enable — every other port is closed to the network.

Won't default-deny break things?

Only inbound services you forgot to allow. Start with outgoing allowed and open inbound ports one at a time as you need them.

Go deeper: Build a Hardened Linux Workstation

The complete, step-by-step guide — every command, config, and the reasoning behind it.

Get the guide