Securing a Linux server or desktop should always be your first priority. While Linux kernel uses the powerful iptables (or nftables) to manage network traffic, configuring these tools directly can be incredibly complex. This is where UFW (Uncomplicated Firewall) comes in. UFW provides a user-friendly command-line interface for managing your firewall, making it simple to allow or block specific ports and services on Ubuntu.
In this guide, we will walk through the essential commands needed to secure your Ubuntu system using UFW.
What is UFW?
UFW is a front-end for iptables designed to simplify firewall configuration. It is installed by default on all modern versions of Ubuntu. UFW operates on a “deny by default” philosophy for incoming traffic, meaning that once activated, it will block all external connections to your machine unless you explicitly allow them.
How to Enable and Disable UFW
Before making any changes, you can check the current status of your firewall. By default, UFW is inactive on a fresh Ubuntu installation.
- To check the status, open your terminal and run:
sudo ufw status - If the output says “Status: inactive”, you need to enable it. Important Warning: If you are configuring a remote server via SSH, do not enable UFW yet! You must allow SSH connections first, or you will immediately lock yourself out of the server.
- To enable UFW, run:
sudo ufw enable - To disable the firewall at any time (for troubleshooting), run:
sudo ufw disable
Setting Default UFW Policies
The best practice for any firewall is to deny all incoming traffic and allow all outgoing traffic. This ensures your server can download updates and communicate outwardly, but external actors cannot initiate a connection to your machine.
To set these default rules, execute the following commands:
sudo ufw default deny incomingsudo ufw default allow outgoing
How to Allow or Deny Specific Ports and Services
Now that your firewall is active and denying incoming connections, you need to open ports for the services you actually want to use.
Allowing SSH (Crucial for Remote Servers)
To ensure you do not lose access to a remote server, allow SSH connections before enabling UFW:
sudo ufw allow ssh
UFW translates “ssh” into port 22 automatically based on the /etc/services file. You can also specify the port number directly:
sudo ufw allow 22/tcp
Allowing HTTP and HTTPS Traffic
If you are running a web server (like Nginx or Apache), you need to open ports 80 (HTTP) and 443 (HTTPS). You can do this by service name or port number:
sudo ufw allow httporsudo ufw allow 80/tcpsudo ufw allow httpsorsudo ufw allow 443/tcp
Denying Traffic
If you need to explicitly block a port that was previously opened, use the deny command. For example, to block port 3306 (MySQL):
sudo ufw deny 3306/tcp
Deleting UFW Rules
If you make a mistake, or if you stop using a specific service, you should delete the corresponding firewall rule to maintain tight security.
The easiest way to delete rules is by viewing them as a numbered list.
- List your current rules with their corresponding numbers:
sudo ufw status numbered - Locate the number of the rule you wish to delete (for example, rule number 3).
- Run the delete command:
sudo ufw delete 3 - UFW will ask for confirmation. Type
yand press Enter.
Advanced Tips for Managing UFW
- Allowing Specific IP Addresses: Instead of opening a port to the entire internet, you can restrict access to a single IP address. For example, to allow SSH access only from your home IP (e.g., 192.168.1.100):
sudo ufw allow from 192.168.1.100 to any port 22 - Reloading the Firewall: If you ever make manual changes to UFW configuration files, you need to reload the firewall for them to take effect:
sudo ufw reload - Resetting UFW: If your rules have become a mess and you want to start over, you can reset UFW. This will disable the firewall and delete all active rules:
sudo ufw reset
By mastering these basic UFW commands, you can significantly enhance the security of your Ubuntu systems without needing to learn complex iptables syntax.