Part 2 · Lesson 10 · Intermediate

Firewalls & Security Groups

Every packet is interrogated at the door.

In this interactive Infrastructure lesson from Stencel Academy you don't just read — you type real commands like sudo ufw status verbose, curl --connect-timeout 5 web-01.stencel.ai:5432, curl http://web-01.stencel.ai/ and watch the machine respond on a live, animated map. It is part of the free How Infrastructure Works course.

Key takeaway: Firewalls default-deny: a port is closed unless a rule opens it, and who may knock matters.

Before this lesson

Builds on: TLS & Certificates.

What you'll practise

sudo ufw allow from 10.0.0.0/16 to any port 9100 — Open a port to the private subnet only — a security group rule in miniature.
nc -zvw2 web-01.stencel.ai 443 — Probe a single port without speaking HTTP.
sudo iptables -L ufw-user-input -n | head -6 — ufw compiles your rules into kernel iptables chains.
sudo ufw status numbered — Numbers let you delete rules by position.

Terms you'll learn

firewallsecurity groupdefault denyingressDROP vs REJECT

Check your understanding

Port 80 answered instantly; port 5432 hung forever. Why?

No rule allows 5432, so the firewall silently drops the SYN
Postgres is slower than nginx
Port 5432 doesn't exist on Linux

Open the interactive lesson →