How To Set Up a Firewall with UFW on Ubuntu 18.04 – DigitalOcean

Introduction

UFW, or Uncomplicated Firewall, is an interface for iptables that is aimed at simplifying the process of configuring a firewall. While iptables is a solid and flexible tool, it can be difficult for beginners to learn how to use it to properly configure a firewall. If you’re looking to start protecting your network and aren’t sure which tool to use, UFW may be the right choice for you.

This tutorial will show you how to set up a firewall with UFW on Ubuntu 18.04.

Prerequisites

To follow this tutorial, you will need:

An Ubuntu 18.04 server with

• a non-root sudo user, which you can configure by following steps 1-3 in the tutorial Initial Server Setup with Ubuntu 18.04

.

UFW is installed by default on Ubuntu. If it has been uninstalled for some reason, you can install it with sudo apt install ufw.

Step 1 — Make sure that

IPv6 is enabled

In recent versions of Ubuntu, IPv6 is enabled by default. In practice, that means that most firewall rules added to the server will include an IPv4 version and an IPv6 version, the latter identified by v6 within the UFW status command output. To ensure that IPv6 is enabled, you can check your UFW configuration file at /etc/default/ufw. Open this file using nano or your favorite command line editor:

1. sudo nano /etc/default/ufw

Then make sure the IPV6 value is set to yes. It should look like this:

IPV6 = yes

Save and close the file. If you are using nano, you can do so by typing CTRL+X, then Y and ENTER to confirm.

When UFW is enabled in a later step of this guide, it will be configured to write both IPv4 and IPv6 firewall rules.

Step 2 — Default Policy Settings

If you’re just getting started with UFW, a good first step is to check your default firewall policies. These rules control how you handle traffic that does not explicitly match any other rule.

By default, UFW is configured to deny all incoming connections and allow all outbound connections. This means that anyone trying to reach your server would not be able to connect, while any application inside the server could reach the outside world. Additional rules are included to allow specific services and ports as exceptions to this general policy.

To ensure that you will be able to follow the rest of this tutorial, you will now configure your default UFW policies for inbound and outbound traffic.

To set the default UFW inbound policy to deny, run: sudo ufw default deny input OutputDefault inbound policy changed to ‘deny’ (be sure to update the rules accordingly)

To set the default UFW

outbound policy to allow, run:

1. sudo default ufw

allow output OutputDefault

outbound

policy changed to ‘

1. allow

‘ ‘ (be sure to update the rules accordingly)

These commands set the default values to deny incoming connections and allow outbound connections. These firewall defaults alone may be sufficient for a personal computer, but servers usually need to respond to incoming requests from external users. We’ll look at that next.

Step 3 — Allow SSH

connections

If you were to enable your UFW firewall now, it would deny all incoming connections. This means that you’ll need to create rules that explicitly allow legitimate incoming connections (SSH or HTTP connections, for example) if you want your server to respond to those types of requests. If you’re using a cloud server, you’ll probably want to allow incoming SSH connections so you can connect to and manage your server.

Allow the

OpenSSH

UFW application profile

After installation, most applications that rely on network connections will register an application profile within UFW, allowing users to quickly allow or deny external access to a service. You can check which profiles are currently registered

with UFW with: List of sudo

1. UFW

applications OutputAvailable applications: OpenSSH To enable the OpenSSH

application profile, run:

1. sudo ufw allow OpenSSH

Added OutputRule Added Rule (v6)

This will create firewall rules to allow all connections on port 22, which is the port on which the SSH daemon listens by default.

Allow

SSH by service name

Another way to configure UFW to allow incoming SSH connections is by referencing its service name:

ssh.

1. sudo ufw allow ssh

OutputRule added Added rule (v6)

UFW knows what ports and protocols a service uses based on the /etc/services file

.

Allow SSH

by port number

Alternatively, you can write the equivalent rule by specifying the port instead of the application profile or service name. For example, this command works the same as the previous examples:

1. sudo ufw allow 22

OutputRule added Rule added (v6) If you

configured your SSH daemon to use a different port, you will need to specify the appropriate port. For example, if

your SSH server is listening on port 2222, you can use this command to allow connections on that port:

1. sudo ufw allow 2222

OutputRule added Added rule (v6) Now that your firewall is configured to allow incoming SSH connections, you can enable it.

Step 4 — Enabling UFW

Your firewall should now be configured to allow SSH connections.

To check which rules were added so far, even when the firewall is still disabled

, you can use: sudo ufw show added user rules from OutputAdded (see ‘ufw status’ for running firewall): ufw allow OpenSSH After confirming that you have a rule

to allow incoming SSH connections

, You can enable the firewall with:

1. sudo ufw enable

OutputCommand can interrupt existing ssh connections.

Continue with the operation (y|n)? and Firewall is active and enabled at system startup

You will receive a warning that the command may interrupt existing SSH connections. You’ve already set up a firewall rule that allows SSH connections, so it should be okay to continue. Reply to the message with y and press ENTER.

The firewall is already active. Run the sudo ufw status verbose command to see the rules set. The rest of this tutorial covers how to use UFW in more detail, how to allow or deny different types of connections.

Step 5 — Allow Other Connections

At this point, you should allow all other connections that your server needs to respond to. The connections you should allow depend on your specific needs. You already know how to write rules that allow connections based on an application profile, service name, or port; it already did so for SSH on port 22. You can also do this to:

HTTP on port 80, which is what unencrypted web servers use, using sudo ufw allow http or sudo ufw allow 80 HTTPS on port 443,

• which is what encrypted web servers use

, using sudo ufw allow https or sudo ufw allow 443 Apache with HTTP and HTTPS,

• Using sudo ufw allow

‘

• Apache

Full’ Nginx with

• HTTP and HTTPS, using sudo ufw allow ‘Nginx Full’

Don’t

forget to check which application profiles are available for your server with the sudo ufw application list

.

There are several other ways to allow connections in addition to specifying a known port or service name. We’ll look at some of these below.

Specific

port ranges

You can specify port ranges with UFW. Some applications use multiple ports, rather than a single port.

For example, to allow

X11 connections, which use ports 6000-6007, use these commands

: sudo ufw allow 6000:6007/tcp

1. sudo ufw allow 6000:6007/

udp

When specifying port ranges with UFW, you must specify the protocol (tcp or udp) to which the rules should apply. We haven’t mentioned this before because not specifying the protocol automatically allows both protocols, which is fine in most cases.

Specific

IP addresses

When working with UFW, you can also specify IP addresses within your rules. For example, if

you want to allow connections from a specific IP address, such as a work or home IP address of 203.0.113.4, you must use the from parameter, providing the IP address you want to allow:

1. sudo ufw allow from 203.0.113.4

OutputRule added

You can also specify a port to which the IP address is allowed to connect by adding to any port followed by the port number. For example, if

you want to allow 203.0.113.4 to connect to port 22 (SSH), use this command:

1. sudo ufw allow from 203.0.113.4 to any port 22

OutputRule

added subnets

If you want to allow a subnet of IP addresses, you can do so by using CIDR notation to specify a netmask. For example, if you want to allow all IP addresses ranging from

203.0.113.1 to 203.0.113.254, you can use this command: sudo ufw allow from 203.0.113.0/24 OutputRule added Similarly, you can also specify the destination port to which the 203.0.113.0/24 subnet can be connected.

Again, we’ll use port 22 (SSH) as an example:

1. sudo ufw allow from 203.0.113.0/24 to any port 22

OutputRule added

connections

to a specific network interface

If you want to create a firewall rule that only applies to a specific network interface, you can do so by specifying “allow on” followed by the name of the network interface

.

You may want to search for your network interfaces before proceeding. To do so, use this command

:

1. ip addr

Output Excerpt2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state . . . 3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default . . .

The highlighted output indicates the names of the network interface. They are usually called something like eth0 or enp3s2.

Therefore, if your server has a public network interface named eth0, you can allow HTTP traffic (port 80)

with this command:

1. sudo ufw allow entry in eth0 to any port 80

Added Outbound Rule Added Rule (v6)

Doing so could cause your server to receive HTTP requests from the public Internet.

Or, if you want your MySQL database server (port 3306) to listen for connections on the eth1 private network interface, for example, you could use this command:

1. sudo ufw allow entry on eth1 to any port 3306

Added OutputRule Added rule (v6)

This would allow other servers on your private network to connect to your MySQL database

.

Step 6 — Deny

Connections

If you have not changed the default policy for incoming connections, UFW is configured to deny all incoming connections. This typically simplifies the process of creating a secure firewall policy by requiring the creation of rules that explicitly allow specific ports and IP addresses to pass.

However, sometimes you’ll want to deny specific connections based on the source or subnet IP address, perhaps because you know your server is being attacked from there. In addition, if you want to change the default inbound policy to allow (which is not recommended), you must create deny rules for any service or IP address for which you do not want to allow connections.

To write deny rules, you can use the commands described above, replacing allow with deny.

For example, to deny HTTP connections, you can use this command: sudo ufw deny http OutputRule added Rule added (v6) Or if you want to deny all connections from 203.0.113.4 you can

use this command:

1. sudo ufw deny

from

1. 203.0.113.4

OutputRule added

In some cases, you may also want to block outgoing connections from the server. To prevent all users from using a server port, such as port 25 for SMTP traffic, you can use deny out followed by the port number:

1. sudo ufw deny 25

OutputRule added Added rule (v6)

This will block all outbound SMTP traffic on the server

.

Step 7 — Delete

Rules Knowing how to

delete firewall rules is just as important as knowing how to create them. There are two different ways to specify which rules to delete: by rule number or by their human-readable denomination (similar to how the rules were specified when they were created).

Delete a UFW

rule by number

To delete a UFW rule by its number, you’ll first want to get a numbered list of all firewall rules. The UFW status command has an option to display numbers next to each rule, as shown here

:

1. sudo numbered ufw status

Numbered output:Status: active For action From – – – [ 1] 22 ALLOW ON 15.15.15.0/24 [ 2] 80 ALLOW ANYWHERE

If you decide that you want to delete rule number 2, which allows connections from port 80 (HTTP), you can specify it in a UFW delete command like this

:

1. sudo ufw delete 2

OutputDelete: allow 80 Continue operation (y|n)? and Rule

removed This will prompt for an acknowledgement and then delete rule 2, which allows HTTP connections. Note that if you have IPv6 enabled, you’ll also want to delete the corresponding IPv6 rule.

Delete a

UFW

rule by name Instead of using rule numbers,

you can also refer to a rule by its human-readable name, which is based on the type of rule (typically allow or deny) and the name of the service or port number that was the destination of this rule. or the name of the application profile if it has been used. For example, if you want to delete an allow rule for an application profile named Apache Full that was previously enabled, you can use:

1. sudo ufw delete allow “Apache Full”

OutputRule deleted Deleted rule (v6)

The delete command works the same way for rules that were created by referring to a service by name or port. For example, if you previously set a rule to allow HTTP connections

with sudo ufw allow http, here’s how you could delete that rule:

1. sudo ufw delete allow http

OutputRule deleted Deleted Rule (v6) Because

service names are interchangeable with port numbers when specifying rules, you can also reference the same rule as allow 80. Instead of allowing http

: sudo ufw delete

1. allow 80

OutputRule deleted Rule deleted (v6)

When you delete UFW rules by name, IPv4 and IPv6 rules are deleted if they exist.

Step 8 — Check

UFW status and rules

At any time, you can check the status of UFW with this command:

1. sudo detailed ufw status

If UFW is disabled, which is by default, you will see something like this

: OutputStatus: Inactive

If UFW is active, which it should be if you followed step 3, the output will say it is active and list the rules set. For example, if your firewall is configured to allow SSH connections (port 22) from anywhere, the output might look similar

to the following: OutputStatus: active Registration: enabled (low) Default: deny (inbound), allow (outbound), disabled (routed) New profiles: jump into action From – – – 22/tcp ALLOW ANYWHERE Use the

status command if you want to check how UFW has configured the firewall.

Step 9 — Disabling or resetting UFW (optional)

If you decide you don’t want to use UFW, you can disable it with this command:

1. sudo ufw disable

OutputFirewall stopped and disabled at system startup

Any rules you created with UFW will no longer be active. You can always run sudo ufw enable if you need to activate it later.

If you already have UFW rules configured but decide you want to start over, you can use the reset:

1. sudo ufw reset

OutputResetting all rules to installed defaults command. This can disrupt existing ssh connections. Continue with the operation (y|n)? and Backup ‘user.rules’ to ‘/etc/ufw/user.rules.20210729_170353’ Backup ‘before.rules’ to ‘/etc/ufw/before.rules.20210729_170353’ Backup ‘after.rules’ to ‘/etc/ufw/after.rules.20210729_170353’ Backup ‘user6.rules’ to ‘/etc/ufw/user6.rules.20210729_170353’ Backup ‘before6.rules’ to ‘/etc/ufw/before6.rules.20210729_170353’ Backup ‘after6.rules’ to ‘/etc/ufw/after6.rules.20210729_170353’

This will disable UFW and remove any rules that have been previously defined. This should give you a fresh start with UFW. Note that the default policies will not change to their original settings, if you modified them at any time.

Conclusion

Your firewall is now configured to allow (at least) SSH connections. Be sure to allow any other incoming connections that your server requires, while limiting unnecessary connections, so that your server is functional and secure.

For information about the most common UFW configurations, see the UFW Essentials: Common Firewall Rules and Commands tutorial.