UFW Basics on Linux
Uncomplicated Firewall (UFW) is a command-line tool designed to simplify firewall management on Linux systems. It is built on top of iptables, and provides a user-friendly way to define rules to control network traffic.
UFW can be used to create rules to control both IPv4 and IPv6 traffic. UFW is also a stateful firewall. This means that it will automatically keep track of connections and allow packets in the reverse direction for the same connection even if a rule for that direction is not specified.
The Basics
To verify the status of ufw, the status option can be used.
sudo ufw status
The above command will indicate of the firewall is active or not.
To enable the firewall (recommended only after configuring rules), the enable option can be used.
sudo ufw enable
After running the above command, the following message will be displayed, indicating that it is active.
Firewall is active and enabled on system startup
Note: It is recommended to configure the rules before enabling the firewall to prevent locking yourself out of the system.
To disable UFW, the disable option can be used.
sudo ufw disable
Note: When disabling the firewall, it will fully disable the firewall service on the system.
To view configured rules, the verbose option can be used with the status option.
sudo ufw status verbose
Default Policies
By default, UFW is configured to:
- Block all incoming connections
- Allow all outgoing connections
To view the current default policy, the verbose option can be used with status. This will provide additional information from the status command.
sudo ufw status verbose
It is recommended to block all incoming traffic and configure rules to allow specific incoming traffic while allowing all outgoing traffic.
To configure the default policy, the following can be used.
sudo ufw default <allow/deny> <incoming/outgoing>
An example to block all incoming traffic:
sudo ufw default deny incoming
To allow all outgoing traffic:
sudo ufw default allow outgoing
Configuring Rules
When configuring rules to allow or deny specific traffic, the allow and deny options can be used.
sudo ufw <allow/deny> from <ip>
An example to allow traffic from a specific IP address:
sudo ufw allow from 192.168.1.1
To allow or deny a subnet, the following can be used.
sudo ufw <allow/deny> from <ip address/CIDR>
An example to block all traffic from the 10.1.0.0/24 network:
sudo ufw deny from 10.1.0.0/24
To allow traffic to a specific port, we can specify the port number.
sudo ufw <allow/deny> <port>
An example to allow traffic to port 22:
sudo ufw allow 22
To specify the protocol (TCP/UDP), the following can be used.
sudo ufw <allow/deny> <port>/<tcp/udp>
An example to allow traffic to TCP port 22:
sudo ufw allow 22/tcp
Common services (e.g., SSH, HTTP, HTTPS) can be allowed or denied by specifying it.
sudo ufw <allow/deny> <service>
An example to allow SSH traffic to the system:
sudo ufw allow ssh
To allow or deny specific IP addresses or subnets to a specific port, the following can be used.
sudo ufw allow from <ip/subnet> proto <tcp/udp> to any port <port number>
An example to allow a specific host to access SSH.
sudo ufw allow from 172.20.0.35 proto tcp to any port 22
To delete rules, we can either repeat the specific rule to delete or use line numbers.
sudo ufw delete <allow/deny> from <ip/subnet>
To use line numbers, we can use the numbered option with the status option.
sudo ufw status numbered
This will display all rules with their associated line number. To delete a specific line, we can simply specify the line number.
sudo ufw delete 3
Conclusion
By using UFW, it allows you to better protect your servers by allowing specific IP addresses or networks to connect. This can prevent you from accidentally exposing a service on a random port to the internet without knowing.
The following are some additional resources on UFW:
