Own every packet that crosses your Linux servers
Go from writing your first iptables rule to auditing, migrating, and hardening production firewalls — using nftables, iptables, and firewalld the way they're actually used in the field.
"A firewall rule you can't explain is a liability — I'll make sure you can explain every single one."
— Scott Edwards
What you'll learn
What you'll be able to do
- Explain the difference between stateful and stateless packet filtering and choose the right approach for any architecture
- Write, test, and deploy firewall rules using iptables, nftables, and firewalld with confidence
- Design and enforce zone-based and host-based firewall policies for multi-server Linux environments
- Perform safe in-place upgrades and rule migrations between firewall frameworks without service interruption
- Audit and harden an existing firewall configuration by identifying rule conflicts, redundancies, and security gaps
- Monitor live traffic, interpret firewall logs, and respond to incidents using built-in Linux diagnostic tools
How it works
A school that adapts to you
This isn't a set of static videos. Every lesson is generated live and tuned to where you actually are.
We learn your level
A quick placement check tailors your starting point so you're never bored or lost.
Lessons adapt as you go
Each lesson is written for your pace and your goal, adjusting as your skills grow.
Your AI coach keeps you moving
Checkpoints, feedback, and gentle nudges turn progress into a real result.
The curriculum
What's inside your school
0 modules · 0 lessons
Firewall Fundamentals: Stateful vs. Stateless
Builds the conceptual foundation by contrasting stateful and stateless packet filtering and explaining where each model fits in real architectures.
- 1.1How Linux Firewalls Work Under the HoodIncluded
- 1.2Stateless Filtering: Rules Without MemoryIncluded
- 1.3Stateful Filtering: Connection Tracking ExplainedIncluded
- 1.4Choosing the Right Model for Your ArchitectureIncluded
iptables: Rules, Chains, and Tables
Gives hands-on mastery of iptables syntax, rule ordering, and all four built-in tables for both stateless and stateful use cases.
- 2.1iptables Syntax and Command AnatomyIncluded
- 2.2Building Stateless Rules with iptablesIncluded
- 2.3Adding State: Using conntrack Modules in iptablesIncluded
- 2.4NAT, Mangle, and the Raw TableIncluded
- 2.5Persisting and Restoring iptables RulesetsIncluded
nftables: Modern Firewall Framework
Replaces iptables knowledge with nftables' unified syntax, sets, and maps for cleaner, higher-performance rulesets.
- 3.1nftables Architecture: Tables, Chains, and HooksIncluded
- 3.2Writing Your First nftables RulesetIncluded
- 3.3Sets, Maps, and Verdict MapsIncluded
- 3.4Persisting nftables with systemd and nftables.confIncluded
firewalld: Zone-Based Policy Management
Covers firewalld's zone model, rich rules, and D-Bus API for managing dynamic, multi-interface Linux hosts and servers.
- 4.1firewalld Concepts: Zones, Sources, and InterfacesIncluded
- 4.2Managing Services, Ports, and Protocols with firewall-cmdIncluded
- 4.3Rich Rules and Direct Rules for Advanced PolicyIncluded
- 4.4Designing Zone Policies for Multi-Server EnvironmentsIncluded
Migration, Upgrades, and Zero-Downtime Maintenance
Teaches safe procedures for migrating rulesets between frameworks and upgrading firewall configurations without dropping production traffic.
- 5.1Migrating from iptables to nftablesIncluded
- 5.2Migrating from iptables or nftables to firewalldIncluded
- 5.3Atomic Rule Replacement and Rollback StrategiesIncluded
- 5.4Managing Firewall Changes with Version ControlIncluded
Auditing, Monitoring, and Incident Response
Equips professionals to identify misconfigurations, monitor live traffic, interpret logs, and respond to firewall-level security incidents.
- 6.1Auditing Rules for Conflicts, Redundancies, and GapsIncluded
- 6.2Hardening a Live Firewall ConfigurationIncluded
- 6.3Logging Traffic with iptables, nftables, and firewalldIncluded
- 6.4Monitoring Live Traffic with conntrack, ss, and tcpdumpIncluded
- 6.5Incident Response: Detecting and Blocking Active ThreatsIncluded
Who it's for
Is this you?
Linux sysadmins
You manage Linux servers day-to-day and need firewall skills that go beyond ad-hoc iptables rules — this gives you the architecture and discipline to design configs you can defend.
DevOps engineers
You're automating infrastructure and need to bake firewall policy into your pipelines — the version-control, migration, and zone-policy content maps directly to how modern DevOps environments work.
Security-focused IT pros
You're responsible for hardening Linux environments and need to audit existing firewall configurations, close gaps, and run a real incident response workflow — not just read about it.
Cloud & VPS operators
You run Linux workloads on cloud instances where the host-level firewall is your last line of defense and getting zone-based and stateful filtering right is non-negotiable.
Infrastructure engineers mid-migration
Your stack is somewhere between iptables and nftables — or you've been told to move to firewalld — and you need a clear, zero-downtime migration path, not another half-finished tutorial.
Senior engineers leveling up
You know enough to be dangerous but want the rigorous, framework-level understanding of Linux firewalls that lets you make architecture decisions with confidence rather than habit.
Questions
Frequently asked
Your teacher
A note from your teacher
Scott Edwards
If you've spent any time managing Linux servers in production, you already know the feeling: a firewall ruleset that grew organically over months or years, nobody's entirely sure what half the rules do, and you're the one who has to touch it. Or you've been handed a ticket to migrate from iptables to nftables "without any downtime" and the documentation you've found so far treats you like you've never opened a terminal before.
That's the exact gap I built this school to close. Not the "what is a firewall" gap — you're past that. The gap between knowing the commands and genuinely understanding the architecture. Between getting rules to work and knowing they're correct. Between keeping a firewall running and being the person who designed it with intent.
Everything in this school is command-line first. We start with how Linux firewalls actually work under the hood — netfilter, the kernel hooks, the difference between stateless packet matching and stateful connection tracking — because if you understand the foundation, the tools stop being magic boxes and start being exactly what they are: interfaces to the same underlying system. From there we go deep on iptables (including the parts most tutorials skip, like the mangle and raw tables and conntrack module configuration), through nftables' cleaner architecture with sets and verdict maps, and into firewalld's zone-based model for environments where you're managing policy across multiple servers and interfaces.
The migration and maintenance content is where I see the most real-world pain, so I didn't hold back. Atomic rule replacement, rollback strategies, version-controlling your firewall configs, migrating between frameworks without dropping connections — it's all here, written for environments where you don't get a maintenance window just because you'd like one.
And then the auditing and incident response work at the end, because a firewall you can't inspect and verify is just security theater. You'll leave knowing how to read what your firewall is actually doing — with conntrack, ss, tcpdump, and native logging — and how to respond when something looks wrong.
This school respects your time and your existing knowledge. I'm not going to explain what an IP address is. I am going to push you further than you've gone before on Linux firewall design, maintenance, and defense. If that's the school you've been looking for, let's get to work.
— Scott Edwards
Start your journey today
Get instant access — learn at your own pace with an AI coach in your corner.
$175/yr
Recurring billing · cancel anytime
Secure checkout · Instant access
- 6 modules, 26 lessons
- AI-adaptive lessons tuned to your level
- Quizzes & checkpoints to lock in progress
- Your own AI learning coach
- Learn on any device, at your pace
- Full access for as long as you're subscribed