Introduction to UFW - Uncomplicated Firewall Basics
UFW or Uncomplicated Firewall is Ubuntu’s twist on the old faithful iptables. Personally being an old hat I was very happy with iptables. It worked well and I was proficient enough to write rules on the fly. UFW was built to be a “user friendly” front end for iptables as was Firewalld. There are some things you will need to know right off the bat if you are used to iptables. In this article we will show you all the basics you need to get started with Uncomplicated Firewall.
How to Save Rules in Uncomplicated Firewall
Iptables rules are effective as soon as you hit enter, but they are not persistent. Meaning they will not survive a reboot or a restart. With UFW the rules are effective immediately also, but they are also saved. This took me a minute to figure out. Short story… No need for a save command.
I spent some time searching for the above information, so I figured I would put that front and center. Now let’s hit some basics.
Installing Uncomplicated Firewall
First you will want to ensure UFW is installed.
sudo apt-get install ufw
By default UFW is set to deny all incoming connections, and allow all outgoing connections.
Checking UFW status and Listing UFW rules
sudo ufw status
The status will be either active or disabled.
The above command will also list any rules you have set.
NOTE: You can also add verbose for more information.
sudo ufw status verbose
You can also list them numbered. This comes in handy if you have a large amount of rules.
sudo ufw status numbered
Setting UFW default policy
UFW (and iptables) uses “default policies” to act on traffic that is not explicitly called out by a rule. As a connection request comes in, UFW will check the rules sequentially and if it does not match a rule, it will use the action specified in the default policy.
You can set the default policy to deny incoming traffic like so:
sudo ufw default deny incoming
and allow outgoing traffic like so:
sudo ufw default allow outgoing
Open a specific port on UFW
If you want to open a specific port, say port 22/SSH, it’s simple. We will add the SSH port first before enabling UFW to ensure we do not get locked out of our system.
sudo ufw allow 22
sudo ufw allow ssh
Enabling or Disabling UFW
Once you are sure you have SSH open, you can go ahead and enable UFW.NOTE: You will see a warning about disrupting SSH connections. If you set the 22/SSH port rule above, you will be fine. If not you run the chance of being locked out.
sudo ufw enable
Disable is similar….
sudo ufw disable
Now let’s move on to more interesting configurations.
Opening up a specific port range in UFW
Often it is necessary to open a port range. For example 137-138 for Samba. You can use the colon to specify port ranges like so:
sudo ufw allow 137:138/udp
NOTE: When specifying port ranges, you MUST include the protocol. In this case Samba using 137/138 UDP.
Allowing a connection from a specific host in UFW
You can specific a host that is allowed to connect to your system by IP address like so:
sudo ufw allow from 10.0.0.10
Allowing a connection from specific host on specific port
You can mix and match these rules (port, host, protocol, interface, etc..)
If you want to allow only one specific host to SSH to your system you can do that like so:
sudo ufw allow from 10.0.0.10 to any port 22
Allowing a connection over a specific network interface in UFW
You may want to limit some traffic to a specific network interface, maybe a management interface? To restrict SSH traffic to the eth0 interface:
sudo ufw allow in on eth0 to any port 22
It is good security practice to make your rules as granular as possible. To find the name of your network interface you can use the “ip addr” command.
Allowing connections from a specific network subnet
If you want to allow traffic from a specific subnet, just add the CIDR to the network address like so:
sudo ufw allow from 10.0.0.0/24
and limit that subnet to a specific port:
sudo ufw allow from 10.0.0.0/24 to any port 22
Limit that subnet to a specific port on a specific interface:
sudo ufw allow in on eth0 from 10.0.0.0/24 to any port 22
(See where we are going with this?)
Denying specific traffic in UFW
All of the above “allow” commands can be changed to deny command simply by changing the word allow to deny like so:
Deny traffic from 10.0.0.0/24 subnet:
sudo ufw deny from 10.0.0.0/24
Deny Traffic on port 80:
sudo ufw deny 80
sudo ufw deny http
Deleting Firewall Rules with UFW
You can delete rules by either specifying the number of the rule (view numbered) or typing out the specific rule.
For example, let’s say you wanted to close up port 443:
sudo ufw delete allow 443
You can also use the number of the rule in the chain. We briefly covered using the numbered option above, but here is an example:
[email protected]:~$ sudo ufw status numbered verboseStatus: active To Action From — —— —- [ 1] 22 ALLOW IN Anywhere [ 2] 137/udp ALLOW IN 10.0.0.3 [ 3] 138/udp ALLOW IN 10.0.0.3 [ 4] 139/tcp ALLOW IN 10.0.0.3 [ 5] 445/tcp ALLOW IN 10.0.0.3 [ 6] 22 on enp7s0 ALLOW IN 10.0.0.0/24
Now you can delete the firewall rule using the number, like so:
[email protected]:~$ sudo ufw delete 6 Deleting: allow in on enp7s0 from 10.0.0.0/24 to any port 22 Proceed with operation (y|n)? y Rule deleted
Disabling and resetting Uncomplicated Firewall
You can disable UFW simply by giving it the disable command:
sudo ufw disable
NOTE: Disabling UFW will not delete the rules, if you re-enable it, the rules you set will still be there. Disabling UFW would be handy for testing connection issue to rule out the firewall.
You can also reset UFW. Resetting UFW will delete all the rules and disable the firewall. This will not effect default policies.
sudo ufw reset
Now you should have a good understanding of the basic of UFW. Uncomplicated firewall simplified the administration of iptables a fair amount. Of course being an old hat, I still prefer iptables, respect UFW and I am just getting my head around firewalld basics.
Resources and Links
This site uses Akismet to reduce spam. Learn how your comment data is processed.