How to Configure UFW Firewall
Uncomplicated Firewall (UFW) is the default firewall configuration tool on Ubuntu and most of the debian based distributions. It offers a simplified interface for managing complex iptables rules, making it more straightforward to control incoming and outgoing traffic.
This article explains the most commonly used UFW commands to help secure your server.
Prerequisites
Before you begin, you need to:
- Have access to a Linux server with UFW installed as a non-root user with sudo privileges.
Check UFW Status
Check the status of the firewall. By default, UFW is active on Vultr Compute instances..
CONSOLE
If the output displays the status as
inactive, run the below command to enable UFW.CONSOLEThe command above enables UFW and instantly adds a rule to allow SSH, ensuring your session stays active.
Manage the Firewall
Enable UFW
Activate the UFW firewall to start enforcing the configured rules.
CONSOLEDisable UFW
To disable the firewall and stop enforcing rules.
CONSOLEReset UFW
To delete all existing rules and restore UFW to its default inactive state.
CONSOLE
Common UFW Configuration Examples
To guard your servers against unauthorized access and reduce exposure to potential threats, it's important to allow only the traffic necessary for your applications. This section demonstrates practical UFW configurations for common server scenarios, helping you build a secure and controlled network environment by explicitly permitting essential services while blocking all other unsolicited connections.
Allow SSH and Deny All Other Inbound Traffic
In this section, you configure UFW to allow only SSH connections and block all other inbound traffic. This setup provides a secure baseline for newly deployed servers that do not yet run public-facing services.
Set the default policies to deny all incoming traffic and allow all outgoing traffic.
CONSOLEAllow SSH connections.
CONSOLEView the
ufwstatus.CONSOLEOutput:
Allow Web Server Traffic
To host websites or web applications, your server must be accessible over standard web ports. This configuration allows traffic for essential services HTTP (port 80), and HTTPS (port 443), while blocking all other unsolicited connections.
Allow HTTP traffic.
CONSOLEAllow HTTPS traffic.
CONSOLEView the
ufwstatus.CONSOLEOutput:
Allow a Specific Port
To expose a specific service running on your server, you can allow traffic on its associated port. This is useful for enabling access to applications like databases, VPNs, or custom services.
To allow traffic on a specific port using the TCP protocol, such as MySQL (port
3306):CONSOLEThe command above allows the TCP traffic on port
3306.To allow traffic on a specific port using the UDP protocol, such as for an OpenVPN server (port
1194):CONSOLEThe command above allows the UDP traffic on port
1194.
Allow a Specific IP Address
In cases where you want to limit access to specific, trusted sources such as office networks, VPN gateways, or monitoring systems you can allow traffic from a specific IP address.
To allow all traffic from a trusted IP:
CONSOLETo allow a trusted IP access to a specific port (e.g., SSH):
CONSOLE
Delete a UFW Rule
If you no longer need a rule or have added one incorrectly, you can remove it using its rule number.
Run the below command to list all the
activerules with numbering:CONSOLEDelete a rule using it's number.
CONSOLE
Conclusion
In this article, you have explored how to secure your Linux server using UFW. You configured default firewall policies, allowed essential services like SSH and web traffic, opened specific ports and protocols, whitelisted trusted IP addresses, and also have deleted unwanted firewall rules.
Tags:Ubuntu / Debian
0 Comments
Be the first to comment and share your perspective with the community.