How to Configure Ubuntu Server UFW for Port Forwarding

The Uncomplicated Firewall (UFW) is the default firewall configuration tool for Ubuntu. It is designed to be a user-friendly frontend for iptables. While UFW excels at simple tasks like allowing or blocking specific ports (e.g., ufw allow 22), more complex networking tasks—such as port forwarding—require you to dig into UFW’s configuration files. Port forwarding is essential when your Ubuntu server acts as a gateway or router, taking traffic that arrives on one port (like 80) and redirecting it to a different port (like 8080) or even a completely different internal IP address.

Step 1: Enable IP Forwarding in the Kernel

Before UFW can forward any packets, the Linux kernel itself must be allowed to route traffic between interfaces. By default, Ubuntu disables this feature for security.

1. Open the sysctl configuration file:
   sudo nano /etc/sysctl.conf
2. Find the following line and remove the # to uncomment it:
   net.ipv4.ip_forward=1
3. Save the file and apply the changes immediately without rebooting:
   sudo sysctl -p

Step 2: Modify UFW Default Forwarding Policy

Next, you must tell UFW that forwarding traffic is acceptable.

1. Open the UFW default configuration file:
   sudo nano /etc/default/ufw
2. Locate the DEFAULT_FORWARD_POLICY directive. Change it from “DROP” to “ACCEPT”:
   DEFAULT_FORWARD_POLICY="ACCEPT"
3. Save and exit the file.

Step 3: Add the Port Forwarding Rules (NAT)

This is the most critical step. UFW does not have a simple command-line flag for port forwarding, so you must write raw iptables rules into UFW’s before.rules file. These rules are processed before the standard UFW allow/deny rules.

1. Open the before.rules file:
   sudo nano /etc/ufw/before.rules
2. Scroll to the very top of the file. You must insert your Network Address Translation (NAT) rules before the *filter section begins.
3. Add the following block of code. Modify the IP addresses and ports to match your scenario. In this example, we are forwarding any traffic that hits port 80 on the public interface (eth0) to an internal web server at 192.168.1.100 on port 8080.

   *nat
   :PREROUTING ACCEPT [0:0]
   # Forward traffic from port 80 to internal IP 192.168.1.100 on port 8080
   -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100:8080
   # Setup SNAT (Masquerading) if returning traffic needs to go through the gateway
   -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
   COMMIT

4. Save and exit the file.

Note: Ensure you replace eth0 with your actual public network interface name (e.g., ens33 or enp3s0). You can find this using the ip a command.

Step 4: Allow the Port Through the Firewall

Even though you set up the forwarding rule, UFW’s standard filter still applies. You must explicitly allow traffic to hit port 80.

sudo ufw allow 80/tcp

Step 5: Restart UFW

Finally, reload the UFW service to parse the new before.rules file and apply the NAT configuration.

sudo ufw reload

Test your configuration by attempting to connect to the external IP address of your Ubuntu server on port 80. The traffic should instantly route to your internal application server.