How to Set Up Firewall Policies using Uncomplicated Firewall (UFW)
Uncomplicated Firewall (UFW) is a network packet filtering application that runs on Linux servers, and is the default firewall front end on Debian-based distributions such as Ubuntu. UFW filters network packets based on server interfaces, ports, and services, presenting a simplified command syntax over the underlying iptables or nftables rules.
This article explains how to set up firewall policies using UFW on a Linux server. It covers enabling the firewall without losing remote access, setting default policies for incoming and outgoing traffic, creating port and service rules, restricting traffic by source address and network interface, annotating rules with comments, and removing rules safely.
Prerequisites
Before you begin, you need to:
- Have access to an Ubuntu server as a non-root user with sudo privileges.
- Update the installed packages on the server.
Enable UFW
UFW ships with Ubuntu and is installed by default, but it starts in a disabled state so that a new server remains reachable. Enabling the firewall while no rules exist drops your SSH session, so add an SSH rule first.
Check the current firewall status.
CONSOLEThe output reports the firewall state.
Note
Status: inactivemeans UFW is installed but disabled. It does not mean the package is missing. On a distribution that does not ship UFW, install it withsudo apt install ufwbefore continuing.Allow the SSH port so that enabling the firewall does not end your session.
CONSOLEThe output confirms
Rule added.Enable the firewall.
CONSOLEThe command warns that it may disrupt existing SSH connections and asks for confirmation. Enter
yto proceed. UFW also configures itself to start automatically at boot.Verify that the firewall is active and the SSH rule is present.
CONSOLEThe output displays the active state and the applied rules.
UFW creates a matching IPv6 rule for every IPv4 rule when IPv6 support is enabled.
Set Default Policies
Default policies decide what happens to traffic that no rule matches. Setting a restrictive default for incoming traffic and a permissive default for outgoing traffic gives you a deny-by-default posture while leaving the server able to reach package repositories and other external services.
Allow all outgoing connections from the server.
CONSOLEDeny all incoming connections to the server.
CONSOLENote
This policy blocks every inbound connection that no rule explicitly allows, including SSH. Confirm that the SSH rule from the previous section is present before applying it.
Deny all forwarded traffic.
CONSOLEThis policy blocks traffic routed through the server. Leave forwarding allowed if the server acts as a NAT gateway or router for other hosts.
Review the policies together with the rule list.
CONSOLEThe output reports the default policies on the
Defaultline.
Allow Specific Ports
Port rules are the most common UFW rules. A rule that names only a port number covers both TCP and UDP, while appending a protocol restricts the rule to that protocol alone.
Allow a port for both protocols, such as the HTTP port
80.CONSOLEAllow a port for TCP only, such as the HTTPS port
443.CONSOLEThe rule accepts TCP connections on port
443and blocks UDP traffic to the same port.Allow a port for UDP only, such as the DNS port
53.CONSOLEAllow a range of ports by specifying the protocol.
CONSOLEUFW requires a protocol when you specify a port range.
View the resulting rules.
CONSOLE
Deny Specific Ports
A deny rule blocks traffic to a port explicitly. With a default incoming policy of deny, an explicit deny rule mainly documents intent or overrides a broader allow rule that appears later in the table.
Deny connections to an internal service port such as the MySQL port
3306.CONSOLEDeny a port for a single protocol.
CONSOLEView the rules to confirm the deny entries.
CONSOLEThe
Actioncolumn displaysDENYfor the blocked ports.
Allow Application Profiles and Named Services
UFW recognizes well-known service names as well as application profiles that packages register when they are installed. A profile groups every port a service needs, so one rule covers all of them instead of several port rules.
List the application profiles available on the server. UFW reads them from the
/etc/ufw/applications.ddirectory.CONSOLEA server with only OpenSSH installed lists a single profile.
Note
A profile exists only after the package that provides it is installed. Rules such as
sudo ufw allow 'Nginx Full'fail withERROR: Could not find a profile matching 'Nginx Full'until Nginx is installed on the server.Inspect the ports a profile covers before applying it.
CONSOLEAllow an application profile.
CONSOLEAllow a named service such as FTP.
CONSOLEUFW resolves the name against the
/etc/servicesfile and adds a rule for21/tcp.
Set Up Directional Rules
Directional rules restrict traffic by source address, destination port, or network interface rather than by port alone. Use them to expose a service to a single administrative address instead of the whole internet.
Allow SSH from a single source address. Replace
192.0.2.100with the address you connect from.CONSOLEUFW accepts SSH connections from that address and blocks the port for every other source.
Allow a source subnet rather than a single address.
CONSOLEAllow incoming traffic on a specific network interface. Replace
enp1s0with your interface name.CONSOLEUFW accepts HTTP connections arriving on that interface and blocks the port on all other interfaces.
Allow outgoing traffic on a specific interface.
CONSOLEDeny traffic from a specific source address.
CONSOLENote
Each octet of an IPv4 address must be between
0and255. UFW rejects an out-of-range value withERROR: Bad source address.Find your interface names if you do not know them.
CONSOLE
Add Comments to Rules
A rule table without comments becomes difficult to audit once it holds more than a few entries. Comments record why a rule exists and appear in the status output alongside the rule.
Add a comment to a source-restricted SSH rule.
CONSOLEAdd a comment to a port rule.
CONSOLEView the rules with their comments.
CONSOLEThe comment appears after a
#at the end of each rule.
Delete Rules
UFW deletes rules either by their position in the table or by repeating the rule specification. Deleting by specification is safer, because position numbers change every time a rule is removed.
List the rules with their position numbers.
CONSOLEPosition numbers appear in brackets at the start of each line. The plain
sudo ufw statuscommand does not display them.Delete a rule by its specification. This removes the IPv4 and IPv6 entries together.
CONSOLEThe output confirms
Rule deletedandRule deleted (v6).Delete a rule by position number when the specification is long.
CONSOLEEnter
ywhen prompted to confirm the deletion.Note
UFW renumbers the remaining rules immediately after each deletion. Run
sudo ufw status numberedagain before deleting another rule by number, because the number you noted earlier now refers to a different rule.Verify the resulting table.
CONSOLE
Manage the Firewall
Routine operation involves reloading after manual configuration changes, and occasionally disabling or resetting the firewall during troubleshooting.
Reload the firewall after editing files in
/etc/ufwdirectly.CONSOLERules added with the
ufwcommand apply immediately and do not require a reload.Disable the firewall without removing its rules.
CONSOLEReset the firewall to its default state, removing every rule.
CONSOLEEnter
ywhen prompted. The command disables the firewall and backs up the previous rules to/etc/ufw.Note
Resetting removes the SSH rule as well. Add it again before re-enabling the firewall on a remote server.
Conclusion
You have enabled UFW, set default policies for incoming and outgoing traffic, created port, service, and directional rules, annotated them with comments, and removed rules safely. Combine UFW with a network-level firewall to filter traffic before it reaches the server, and edit the configuration files in /etc/ufw for advanced rules that run before or after the generated rule set. For more information, see the UFW manual page and the Ubuntu firewall documentation.
0 Comments
Be the first to comment and share your perspective with the community.