Skip to main content

Firewall & Networking Cheat Sheet

· 4 min read

Network Diagnostics​

Basic Connectivity​

  • ping [host] - Test connectivity to a host
  • ping -c 4 [host] - Send 4 packets (Linux/Mac)
  • traceroute [host] - Show route packets take to destination (Linux/Mac)
  • tracert [host] - Show route packets take to destination (Windows)
  • mtr [host] - Combined ping and traceroute (Linux)

Network Information​

  • ifconfig - Display network interfaces (Linux/Mac, deprecated)
  • ip addr show - Display IP addresses and interfaces (Linux, modern)
  • ip link show - Display network interfaces status
  • ipconfig - Display network configuration (Windows)
  • ipconfig /all - Detailed network configuration (Windows)
  • hostname -I - Show all IP addresses of the host

DNS​

  • nslookup [domain] - Query DNS for domain information
  • dig [domain] - Detailed DNS lookup (Linux/Mac)
  • host [domain] - Simple DNS lookup
  • dig +short [domain] - Brief DNS response
  • nslookup -type=mx [domain] - Query MX records

Port Scanning & Connections​

  • netstat -tuln - Show listening ports (Linux)
  • netstat -ano - Show all connections with process IDs (Windows)
  • ss -tuln - Modern alternative to netstat (Linux)
  • lsof -i :[port] - Show process using specific port (Linux/Mac)
  • nc -zv [host] [port] - Test if port is open (netcat)
  • telnet [host] [port] - Test port connectivity
  • nmap [host] - Scan ports on target host
  • nmap -p- [host] - Scan all ports

Network Statistics​

  • netstat -s - Display network statistics
  • iftop - Real-time bandwidth monitoring (Linux)
  • nethogs - Monitor bandwidth per process (Linux)
  • tcpdump -i [interface] - Capture network packets
  • tcpdump -i eth0 port 80 - Capture HTTP traffic

Linux Firewalls​

iptables​

  • iptables -L - List all rules
  • iptables -L -v -n - List rules with verbose output
  • iptables -A INPUT -p tcp --dport 22 -j ACCEPT - Allow SSH
  • iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT - Allow subnet
  • iptables -A INPUT -p tcp --dport 80 -j DROP - Block port 80
  • iptables -D INPUT [rule_number] - Delete rule by number
  • iptables -F - Flush all rules (caution!)
  • iptables -P INPUT DROP - Set default policy to DROP
  • iptables-save > /etc/iptables/rules.v4 - Save rules
  • iptables-restore < /etc/iptables/rules.v4 - Restore rules

firewalld (RHEL/CentOS/Fedora)​

  • firewall-cmd --state - Check firewall status
  • firewall-cmd --list-all - List all settings
  • firewall-cmd --get-zones - List all zones
  • firewall-cmd --get-active-zones - Show active zones
  • firewall-cmd --zone=public --add-port=8080/tcp - Open port temporarily
  • firewall-cmd --zone=public --add-port=8080/tcp --permanent - Open port permanently
  • firewall-cmd --reload - Reload firewall rules
  • firewall-cmd --zone=public --add-service=http - Allow service
  • firewall-cmd --zone=public --remove-port=8080/tcp --permanent - Remove port
  • firewall-cmd --list-ports - List open ports

ufw (Ubuntu/Debian)​

  • ufw status - Check firewall status
  • ufw enable - Enable firewall
  • ufw disable - Disable firewall
  • ufw allow 22 - Allow port 22
  • ufw allow ssh - Allow SSH service
  • ufw allow from 192.168.1.0/24 - Allow subnet
  • ufw deny 80 - Deny port 80
  • ufw delete allow 80 - Remove allow rule
  • ufw status numbered - List rules with numbers
  • ufw delete [number] - Delete rule by number
  • ufw reset - Reset to default settings

Windows Firewall​

netsh (Command Line)​

  • netsh advfirewall show allprofiles - Show all firewall profiles
  • netsh advfirewall set allprofiles state on - Enable firewall
  • netsh advfirewall set allprofiles state off - Disable firewall
  • netsh advfirewall firewall show rule name=all - List all rules
  • netsh advfirewall firewall add rule name="Allow Port 80" dir=in action=allow protocol=TCP localport=80 - Add inbound rule
  • netsh advfirewall firewall delete rule name="Allow Port 80" - Delete rule
  • netsh advfirewall reset - Reset firewall to defaults

PowerShell​

  • Get-NetFirewallRule - List all firewall rules
  • Get-NetFirewallProfile - Show firewall profiles
  • Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True - Enable firewall
  • New-NetFirewallRule -DisplayName "Allow Port 8080" -Direction Inbound -LocalPort 8080 -Protocol TCP -Action Allow - Create rule
  • Remove-NetFirewallRule -DisplayName "Allow Port 8080" - Remove rule
  • Get-NetFirewallRule | Where-Object {$_.Enabled -eq 'True'} - Show enabled rules

Routing​

Linux​

  • ip route show - Display routing table
  • route -n - Display routing table (deprecated)
  • ip route add 10.0.0.0/24 via 192.168.1.1 - Add static route
  • ip route del 10.0.0.0/24 - Delete route
  • ip route get [IP] - Show route to specific IP

Windows​

  • route print - Display routing table
  • route add 10.0.0.0 mask 255.255.255.0 192.168.1.1 - Add static route
  • route delete 10.0.0.0 - Delete route
  • route -p add [destination] mask [netmask] [gateway] - Add persistent route

Network Configuration​

Linux​

  • ip addr add 192.168.1.10/24 dev eth0 - Add IP to interface
  • ip link set eth0 up - Bring interface up
  • ip link set eth0 down - Bring interface down
  • dhclient eth0 - Request DHCP address
  • systemctl restart networking - Restart networking (Debian/Ubuntu)
  • systemctl restart NetworkManager - Restart NetworkManager (RHEL/Fedora)

Windows​

  • ipconfig /release - Release DHCP lease
  • ipconfig /renew - Renew DHCP lease
  • ipconfig /flushdns - Clear DNS cache
  • netsh interface ip set address "Ethernet" static 192.168.1.10 255.255.255.0 192.168.1.1 - Set static IP

Troubleshooting Tips​

  • Always test firewall rules before applying permanently
  • Use --permanent flag with firewalld to make changes persistent
  • Check logs: /var/log/firewalld (firewalld), /var/log/syslog or /var/log/messages (iptables)
  • Remember that some tools require root/administrator privileges
  • Document all firewall changes for future reference