Securing a server or desktop environment against unauthorised network access is a critical first step for any system administrator. While Linux uses the powerful iptables (or nftables) framework to filter network traffic, its syntax can be notoriously complex. To solve this, Ubuntu includes UFW (Uncomplicated Firewall) by default.
UFW is a user-friendly command-line interface for managing iptables. It provides a simple way to configure firewall rules, allowing you to quickly secure your Ubuntu system without needing a deep understanding of networking protocols.
Before You Begin
If you are connected to your Ubuntu server remotely via SSH, do not enable UFW immediately. By default, enabling UFW blocks all incoming connections. If you enable it without first allowing SSH traffic, you will immediately lock yourself out of your own server.
Step 1: Check the Status of UFW
By default, UFW is installed on Ubuntu but is inactive. You can verify its current status by running:
sudo ufw statusIf the firewall is disabled, the output will simply say Status: inactive.
If you want to see verbose output (which includes default policies), use:
sudo ufw status verboseStep 2: Set Default Policies
A good firewall follows a “default deny” policy for incoming traffic and a “default allow” policy for outgoing traffic. This means no external device can connect to your server unless you explicitly allow it, but your server can reach out to the internet to download updates.
To enforce these defaults, run:
sudo ufw default deny incoming
sudo ufw default allow outgoingStep 3: Allow Essential Connections (Like SSH)
Before turning the firewall on, you must explicitly allow the services you need. For most remote servers, this is SSH.
You can allow connections by referencing the service name (UFW reads from /etc/services):
sudo ufw allow sshAlternatively, you can allow the specific port number (SSH typically uses port 22):
sudo ufw allow 22/tcpAllowing Other Common Services
If your server is running a website, you will need to allow HTTP (port 80) and HTTPS (port 443):
sudo ufw allow http
sudo ufw allow httpsIf you are running a custom application on a specific port (e.g., a Node.js app on port 3000), you can allow it directly:
sudo ufw allow 3000Step 4: Enable the Firewall
Once you are certain that SSH (or any other critical remote access method) is allowed, you can enable UFW:
sudo ufw enableYou will see a warning stating that this command may disrupt existing SSH connections. Type y and press Enter to proceed. The firewall is now active and will automatically start when the system boots.
Advanced Rules: Allowing Specific IP Addresses
Sometimes you want to restrict access to a specific port so that only your home or office IP address can connect to it. For example, to allow only the IP address 203.0.113.50 to access a database on port 3306:
sudo ufw allow from 203.0.113.50 to any port 3306You can also allow an entire subnet (e.g., your internal network) to access any port on the server:
sudo ufw allow from 192.168.1.0/24How to Delete UFW Rules
If you make a mistake or no longer need a rule, you can delete it. The easiest way to delete a rule is by referencing its line number.
- First, list all active rules with their corresponding numbers:
sudo ufw status numbered- Locate the number of the rule you wish to remove (e.g., rule 4).
- Delete it using the number:
sudo ufw delete 4UFW will ask for confirmation before deleting the rule.
How to Disable or Reset UFW
If you are troubleshooting a network issue and need to temporarily disable the firewall, run:
sudo ufw disableIf your rules have become too complicated and you want to start fresh, you can reset UFW. This disables the firewall and deletes all custom rules (except for the default policies):
sudo ufw resetUFW lives up to its name by making network security accessible. By understanding how to check its status, set default policies, and allow specific traffic, you can confidently secure any Ubuntu environment in just a few minutes.