Introduction
UFW, or Uncomplicated Firewall, is a simplified firewall management interface that hides the complexity of lower-level packet filtering technologies such as iptables and nftables. If you’re looking to start protecting your network and aren’t sure which tool to use, UFW may be the right choice for you.
This tutorial will show you how to set up a firewall with UFW on Ubuntu 20.04.
Prerequisites
To follow this tutorial, you will need:
An Ubuntu 20.04 server with
- a non-root sudo user, which you can configure by following our tutorial Initial Server Setup with Ubuntu 20.04
.
UFW is installed by default on Ubuntu. If it has been uninstalled for some reason, you can install it with sudo apt install ufw.
Step 1 — Using IPv6 with UFW (optional)
This tutorial is written with IPv4 in mind, but it will work for IPv6 as long as you enable it. If your Ubuntu server has IPv6 enabled, make sure UFW is configured to support IPv6 to manage firewall rules for IPv6 in addition to IPv4. To do this, open UFW settings with nano or your favorite editor.
- sudo nano /etc/default/ufw
Then make sure the IPV6 value is yes. It should look like this:
IPV6 = yes
Save and close the file. Now, when UFW is enabled, it will be configured to write both IPv4 and IPv6 firewall rules. However, before we enable UFW, we’ll want to make sure your firewall is configured to allow you to connect via SSH. Let’s start with setting the default policies.
Step 2 — Default Policy Settings
If you’re just getting started with your firewall, the first rules you need to define are your default policies. These rules control how you handle traffic that does not explicitly match any other rule. By default, UFW is configured to deny all incoming connections and allow all outbound connections. This means that anyone trying to reach your server would not be able to connect, while any application inside the server could reach the outside world.
We’re going to set your UFW rules back to default values so we can be sure you’ll be able to follow this tutorial. To set the default values used by UFW, use these commands:
sudo ufw default deny incoming sudo ufw default allow outgoing These commands set the default values to
- deny incoming
- allow outgoing
and
connections. These firewall defaults alone may be sufficient for a personal computer, but servers usually need to respond to incoming requests from external users. We’ll look at that next.
Step 3 — Allow SSH
connections
If we enable our UFW firewall now, it would deny all incoming connections. This means that we will need to create rules that explicitly allow legitimate incoming connections (SSH or HTTP connections, for example) if we want our server to respond to such requests. If you’re using a cloud server, you’ll probably want to allow incoming SSH connections so you can connect to and manage your server.
To configure the server to allow incoming SSH connections,
you can use this command:
- sudo ufw allow ssh
This will create firewall rules that will allow all connections on port 22, which is the port on which the SSH daemon listens by default. UFW knows what port allow ssh means because it appears as a service in the /etc/services file.
However, we can write the equivalent rule by specifying the port instead of the service name. For example, this command works the same as the previous one:
- sudo ufw allow 22
If you configured your SSH daemon to use a different port, you will need to specify the appropriate port. For example, if
your SSH server is listening on port 2222, you can use this command to allow connections on that port: sudo ufw allow
- 2222
Now that your firewall is configured to allow incoming SSH connections, we can enable it.
Step 4 — Enabling
UFW
To enable UFW, use this command:
- sudo ufw enable
You will receive a warning saying that the command may interrupt existing SSH connections. We already set up a firewall rule that allows SSH connections, so it should be fine to continue. Reply to the message with y and press ENTER.
The firewall is already active. Run the sudo ufw status verbose command to see the rules set. The rest of this tutorial covers how to use UFW in more detail, how to allow or deny different types of connections.
Step 5 — Allow Other Connections
At this point, you should allow all other connections that your server needs to respond to. The connections you should allow depend on your specific needs. Fortunately, you already know how to write rules that allow connections based on a service or port name; we already did this for SSH on port 22. You can also do this to:
HTTP on port 80, which is what unencrypted web servers use, using sudo ufw allow http or sudo ufw allow
- 80 HTTPS on port 443,
- which is what encrypted web servers use
- https or sudo ufw allow 443
, using sudo ufw allow
There are several other ways to allow other connections, in addition to specifying a known port or service.
Specific
port ranges
You can specify port ranges with UFW. Some applications use multiple ports, rather than a single port.
For example, to allow
X11 connections, which use ports 6000-6007, use these commands
: sudo ufw allow 6000:6007/tcp
- sudo ufw allow 6000:6007/
udp
When specifying port ranges with UFW, you must specify the protocol (tcp or udp) to which the rules should apply. We haven’t mentioned this before because not specifying the protocol automatically allows both protocols, which is fine in most cases.
Specific IP addresses
When working with UFW, you can also specify IP addresses. For example, if you want
to allow connections from a specific IP address, such as a work or home IP address of 203.0.113.4, you must specify from, then the IP address:
- sudo ufw allow from 203.0.113.4
You can also specify a specific port to which the IP address is allowed to connect by adding to any port followed by the port number. For example, if
you want to allow 203.0.113.4 to connect to port 22 (SSH), use this command:
- sudo ufw allow from 203.0.113.4 to any port 22
Subnets
If you want to allow an IP address subnet, you can do so by using CIDR notation to specify a netmask. For example, if you want to allow all IP addresses ranging from
203.0.113.1 to 203.0.113.254, you can use this command: sudo ufw allow from 203.0.113.0/24 Similarly, you can also specify the destination port to which the 203.0.113.0/24 subnet can be connected.
Again, we’ll use port 22 (SSH) as an example:
- sudo ufw allow from 203.0.113.0/24 to any port 22
Connections
to a specific
network interface If you want to create a firewall rule that only applies to a specific network interface, you can do so by specifying “allow on” followed by the name of the network interface
.
You may want to search for your network interfaces before proceeding. To do so, use this command
:
- ip addr
Output Excerpt2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state . . . 3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default . . .
The highlighted output indicates the names of the network interface. They are usually called something like eth0 or enp3s2.
Therefore, if your server has a public network interface named eth0, you can allow HTTP traffic (port 80)
with this command:
- sudo ufw allow entry into eth0 to any port 80
If you do, your server might receive HTTP requests from the public Internet. Or
, if you want your MySQL database server (port 3306
) to listen for connections on the eth1 private network interface, for example, you could use this command:
- sudo ufw allow entry on eth1 to any port 3306
This would allow other servers on your private network to connect to your MySQL database
.
Step 6 — Deny
Connections
If you have not changed the default policy for incoming connections, UFW is configured to deny all incoming connections. This typically simplifies the process of creating a secure firewall policy by requiring the creation of rules that explicitly allow specific ports and IP addresses to pass.
However, sometimes you’ll want to deny specific connections based on the source or subnet IP address, perhaps because you know your server is being attacked from there. In addition, if you want to change the default inbound policy to allow (which is not recommended), you must create deny rules for any service or IP address for which you do not want to allow connections.
To write deny rules, you can use the commands described above, replacing allow with deny.
For example, to deny HTTP connections, you can use this command: sudo ufw deny http Or if you want to deny all connections from 203.0.113.4,
you can use this command:
- sudo ufw
- deny from 203.0.113.4
Now let’s take a look at how to
delete rules.
Step 7 — Removing
Rules Knowing how to delete firewall rules is just as important as knowing how
to create them. There are two different ways to specify which rules to delete: by rule number or by the actual rule (similar to how the rules were specified when they were created). We’ll start with the method of deleting by rule number because it’s easier.
By
rule number
If you’re using the rule number to delete firewall rules, the first thing you’ll want to do is get a list of your firewall rules. The UFW status command has an option to display numbers next to each rule, as shown here
:
- sudo numbered ufw status
Output:Status: active To action From – – – [ 1] 22 ALLOW ON 15.15.15.0/24 [ 2] 80 ALLOW ANYWHERE
If we decide that we want to remove rule 2, which allows connections from port 80 (HTTP), we can specify it in a UFW delete command like this:
- sudo ufw delete
2
This would display a confirmation message and then remove rule 2, which allows HTTP connections. Note that if you have IPv6 enabled, you’ll also want to delete the corresponding IPv6 rule.
By
real rule
The alternative to rule numbers is to specify the actual rule to delete. For example
, if you want to delete the allow http rule, you can type it like this: sudo ufw delete allow http
You can also specify the rule by allow 80, instead of by service name:
- sudo ufw delete allow 80
This method will delete the IPv4 and IPv6 rules, if they exist.
Step 8 — Check UFW
status and rules
At any time, you can check the status of
UFW with this command:
- sudo ufw status verbose
If UFW is disabled, which it is
by default, you’ll see something like this
: OutputStatus: Inactive
If UFW is active, which it should be if you followed step 3, the output will say it is active and list the rules set. For example, if your firewall is configured to allow SSH connections (port 22) from anywhere, the output might look similar
to the following: OutputStatus: active Registration: enabled (low) Default: deny (inbound), allow (outbound), disabled (routed) New profiles: jump into action From – – – 22/tcp ALLOW ANYWHERE Use the
status command if you want to check how UFW has configured the firewall.
Step 9 — Disabling or resetting UFW (optional)
If you decide you don’t want to use UFW, you can disable it with this command:
- sudo ufw disable
Any rules you created with UFW will no longer be active. You can always run sudo ufw enable if you need to activate it later.
If you already have UFW rules set up but decide you want to start over, you can use the reset:
- sudo ufw reset
command
This will disable UFW and remove the rules that were previously defined. Note that the default policies will not change to their original settings, if you modified them at any time. This should give you a fresh start with UFW.
Conclusion
Your firewall is now configured to allow (at least) SSH connections. Make sure to allow any other incoming connections your server needs, while limiting any unnecessary connections, to make your server functional and secure.
For information about the most common UFW configurations, see the UFW Essentials: Common Firewall Rules and Commands tutorial.
