Firewalls

A firewall decides which network traffic is allowed in or out of a machine, based on rules you define - packets are filtered directly inside the kernel (a subsystem called netfilter), and you interact with it through one of several higher-level front-ends, depending on distro.

All three ultimately configure the same underlying kernel packet-filtering machinery - firewalld and ufw are just friendlier, higher-level interfaces (service names instead of raw port numbers, simpler zone concepts) built on top of the same low-level engine iptables/nftables talks to directly.

firewalld (RHCSA):

$ firewall-cmd --permanent --add-service=https
$ firewall-cmd --reload
$ firewall-cmd --list-all

ufw (Ubuntu):

$ ufw allow 22/tcp
$ ufw enable
$ ufw status verbose

Warning: firewalld maintains two separate rule sets at once - a runtime configuration (active right now) and a permanent configuration (what gets loaded on the next reload or reboot) - and this split is a classic trap. A rule added without --permanent only affects the current runtime state; the moment the firewall reloads (or the system reboots), it vanishes as if it never existed, because it was never written to the permanent set. And a rule added with --permanent doesn't take effect immediately either - it sits in the permanent config until you explicitly run --reload to load it into the live runtime configuration. You generally need both the --permanent flag on the rule and a follow-up --reload to get a rule that's both active now and durable across restarts.