Setting Up a Port Forwarding Using Uncomplicated Firewall (UFW)

Uncomplicated Firewall (UFW) is a popular and user-friendly command-line interface designed to facilitate firewall management on Ubuntu and other Linux systems. While UFW is typically used to manage inbound and outbound traffic at the port level, it also supports more complex tasks like setting up port forwarding, also known as port mapping. Port forwarding is a networking technique where an incoming network request to a specific port is redirected to a different port, often on a different machine. In this article, we will guide you on how to set up a port forward using UFW.

Understanding the Concepts

Before diving into the details, let’s understand a couple of key concepts:

• Port: In computer networking, a port is a communication endpoint where data enters or leaves a network device, such as a computer or server.
• Forwarding: Forwarding is the process of sending network data from one port to another.
• UFW: Uncomplicated Firewall (UFW) is a front-end interface for iptables, designed to be easy to use while providing advanced features for those who need them.

Setting Up a Port Forward

For demonstration purposes, let’s assume you want to forward incoming traffic on port 8000 to port 8080.

1. Enabling UFW: If not already enabled, start by enabling UFW. Run the following command in the terminal:

   sudo ufw enable 
   

2. Open the UFW configuration file: To set up port forwarding, you must edit the UFW configuration file, located at /etc/default/ufw. You can use any text editor for this, but for simplicity, we’ll use nano:

   sudo nano /etc/default/ufw 
   

3. Enable packet forwarding: In the UFW configuration file, find the line that says DEFAULT_FORWARD_POLICY=”DROP”. Change DROP to ACCEPT so it looks like this: DEFAULT_FORWARD_POLICY=”ACCEPT”. This change allows UFW to forward packets, which is necessary for port forwarding.
   DEFAULT_FORWARD_POLICY="ACCEPT"

   1	DEFAULT_FORWARD_POLICY="ACCEPT"

   Press Ctrl+O to save the changes, then Ctrl+X to exit nano.

4. Modify UFW’s before rules: UFW uses a set of “before rules” that are executed before the standard rules. These before rules can be used to set up port forwarding. Open the before rules file:

   sudo nano /etc/ufw/before.rules 
   

   Add the following lines at the end of the file, replacing <your-ip> with the IP address of the machine where the packets will be forwarded:

   # NAT table rules *nat :POSTROUTING ACCEPT [0:0] # Forward traffic from port 8000 to port 8080. -A PREROUTING -p tcp --dport 8000 -j DNAT --to-destination <your-ip>:8080 # Don’t masquerade local traffic. -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE COMMIT

   1 2 3 4 5 6 7 8 9 10 11

   # NAT table rules *nat :POSTROUTING ACCEPT [0:0]   # Forward traffic from port 8000 to port 8080. -A PREROUTING -p tcp --dport 8000 -j DNAT --to-destination <your-ip>:8080   # Don’t masquerade local traffic. -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE   COMMIT

   Save and close the file using Ctrl+O and Ctrl+X.

5. Restart UFW: Finally, for the changes to take effect, you must restart UFW:

   sudo ufw disable 
   sudo ufw enable 
   

   Now, any incoming traffic to port 8000 will be forwarded to port 8080.

Conclusion

Port forwarding using UFW is an essential technique for managing network traffic in Linux. While it may seem complex at first, understanding the basics and following the steps outlined in this guide can simplify the process significantly. Remember to always back up your configuration files before making changes, and never expose sensitive services to the public internet without proper security measures in place.