How to Enable and Configure the UFW Firewall in Ubuntu

Securing an Ubuntu desktop or workstation against unauthorised inbound connections is a fundamental step in personal system maintenance. Ubuntu comes pre-installed with UFW (Uncomplicated Firewall), a user-friendly frontend interface for Linux’s underlying iptables and nftables network packet filtering frameworks. By default, UFW is disabled after a fresh Ubuntu installation. Enabling it and configuring sensible default rules takes only a couple of simple terminal commands.

Checking Current UFW Firewall Status

Before modifying firewall settings, verify whether UFW is currently active on your Ubuntu system:

1. Open the Terminal application by pressing Ctrl + Alt + T.
2. Type the following status command and press Enter:

   sudo ufw status verbose

3. Enter your administrator account password when prompted.
4. If the output reads Status: inactive, your system is not actively filtering incoming network packets through UFW.

Setting Recommended Default Policies

The safest security baseline for any personal desktop or consumer laptop is to block all unsolicited incoming traffic while permitting all standard outgoing connections (such as browsing the web, downloading updates, and streaming media):

1. Set the incoming policy to deny:

   sudo ufw default deny incoming

2. Set the outgoing policy to allow:

   sudo ufw default allow outgoing

3. These baseline rules ensure that external devices cannot initiate connections to your computer unless you explicitly add an exemption.

Allowing Essential Network Ports (SSH, Web, Local Sharing)

If you connect to your Ubuntu PC remotely or use specific local network services, you must whitelist those services before turning the firewall on:

• SSH (Secure Shell): If you remotely manage your computer from another device, allow port 22:

  sudo ufw allow ssh

• Specific Port Numbers: To open a specific TCP port (for instance, local streaming or media server on port 8080):

  sudo ufw allow 8080/tcp

• Local Subnet Access: To allow another trusted computer on your home Wi-Fi (e.g., 192.168.1.50) full access:

  sudo ufw allow from 192.168.1.50

Enabling the UFW Firewall

Once your default policies and required exemptions are defined, activate the firewall:

1. Run the enable command:

   sudo ufw enable

2. If prompted with a warning that existing connections may be disrupted, type y and press Enter.
3. The terminal will confirm: “Firewall is active and enabled on system startup.”
4. UFW will now launch automatically every time you boot your computer.

Verifying Rules and Disabling UFW

To inspect active rules or disable the firewall during local network troubleshooting:

• View Numbered Rules: Run sudo ufw status numbered to display an indexed list of every active firewall rule.
• Delete a Rule: Run sudo ufw delete [number] using the rule index number from the status list.
• Disable the Firewall: If you ever need to turn off filtering completely, run sudo ufw disable.