Introduction to UFW

UFW (Uncomplicated Firewall) serves as a user-friendly interface for managing iptables firewall rules in Linux environments. Its primary purpose is to simplify the configuration of netfilter firewall policies without requiring deep knowledge of iptables syntax.

While many Linux users focus on commands, APIs, and desktop environments, firewall configuration often receives less attention. Beyond commercial security solutions, Debian-based Linux distributions include UFW as a built-in firewall management tool.

Installation Process

UFW comes pre-installed on Ubuntu systems but requires manual installation on Debian. To install UFW, execute the following commands:

sudo apt update
sudo apt install ufw

Checking Firewall Status

To verify the current state of your firewall, use the verbose status command:

sudo ufw status verbose

The terminal output will indicate whether the firewall is active or inactive, along with the current rules and default policies.

Default Policy Configuration

By default, UFW blocks all incoming connections while permitting all outbound traffic. This means that unless you explicit open specific ports, external attempts to access your server will be danied, while applications running on your server can still connect to external services.

These default policies are defined in the /etc/default/ufw configuration file and can be modified using the sudo ufw default <policy> <chain> command.

Application Profiles

Many software packages include application profiles that describe services and their required UFW settings. During installation, these profiles are automatically created in the /etc/ufw/applications.d directory.

To view all available application profiles, use:

sudo ufw app list

For detailed information about a specific profile and its rules, use the app info command followed by the profile name. For example, to inspect the Samba profile:

sudo ufw app info Samba

Enabling and Disabling UFW

To activate the firewall:

sudo ufw enable

To deactivate the firewall:

sudo ufw disable

Port Management

Depending on the applications running on your server, you'll need to open specific ports. Here are some common examples:

To permit HTTP traffic on port 80:

sudo ufw allow http

Alternatively, you can specify the port number directly:

sudo ufw allow 80/tcp

To enable HTTPS traffic on port 443:

sudo ufw allow https

Or specify the port number:

sudo ufw allow 443/tcp

To open port 8080, commonly used by Tomcat:

sudo ufw allow 8080/tcp

To allow a range of ports, such as ports 8090 through 9090 for both TCP and UDP:

sudo ufw allow 8090:9090/tcp
sudo ufw allow 8090:9090/udp

IP Address Filtering

To permit access from a specific IP address to all ports:

sudo ufw allow from 115.127.62.61

To allow a specific IP address to access only certain ports, such as SSH (port 22):

sudo ufw allow from 115.127.62.61 to any port 22

Subnet Management

Allowing connections from an entire subnet follows a similar syntax but requires specifying a network mask. For example, to permit access from the 192.168.1.0/24 subnet to MySQL's default port (3306):

sudo ufw allow from 192.168.1.0/24 to any port 3306

Network Interface Rules

To restrict access to a specific network interface, such as allowing MySQL connections only on interface eth2:

sudo ufw allow in on eth2 to any port 3306

Blocking Connections

Since the default policy for incoming connections is set to deny, UFW will block all incoming traffic unless explicitly allowed. However, you may need to create specific deny rules in certain scenarios.

For instance, if your server is under attack from the 23.24.25.0/24 network, you can block all connections from this subnet:

sudo ufw deny from 23.24.25.0/24

To block access only to specific ports, such as HTTP and HTTPS:

sudo ufw deny from 23.24.25.0/24 to any port 80
sudo ufw deny from 23.24.25.0/24 to any port 443

Resetting Firewall Rules

To remove all rules and reset UFW to its default state:

sudo ufw reset

Removing Specific Rules

To delete individual rules, first identify them by number:

sudo ufw status numbered

Then remove the desired rule by specifying its number:

# sudo ufw delete [rule_number]
sudo ufw delete 3

Configuring SSH Access

To ensure you can maintain remote acces after enabling the firewall, configure UFW to accept SSH connections:

sudo ufw allow OpenSSH

If your SSH service runs on a non-standard port, such as port 100, explicitly allow that port:

sudo ufw allow 100/tcp