How To Setup a UFW firewall on Ubuntu & Debian

UFW (Uncomplicated Firewall) is a front-end command-line utility for managing iptables rules on a Linux system. It provides a user-friendly, easy-to-manage console command as well as a GUI interface for desktop systems. It is designed to provide an easy for managing firewalls, even the user does not have many ideas about firewalls.

This tutorial will help you to set up a firewall with UFW on an Ubuntu and Debian system.

Let’s begin with the installation of UFW on your system.

How to Install UFW

The Ubuntu and other Debian-based systems have default UFW installed. In case it is not installed, run the following command to install UFW. If it’s already installed, the command will upgrade UFW to the latest version.

Open a terminal and execute:

sudo apt-get update 
sudo apt-get install ufw 

This will install or update UFW on your Debian system.

Enable/Disable UFW

By default, UFW is an inactive state on most of the Debian systems. So use the following command to enable UFW:

Enable UFW

sudo ufw enable 

To disable the UFW, you can use the following command.

Disable UFW

sudo ufw disable 

Check UFW Status

Now make sure ufw is in an active state by executing the following command.

sudo ufw status

Status: active

To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
22 (v6)                    ALLOW       Anywhere (v6)

Enable/Disable IPv6

You might be required to use IPv6 with your firewall. Disable IPv6 support if your system is not configured to use IPv6. To do it edit /etc/default/ufw and set IPV6 “yes” or “no”.

IPV6=no

After making changes disable and enable firewall

sudo ufw disable && sudo ufw enable

Allow Connections with UFW

• Allow Specific Ports – To allow a single port, for example allow port 21(FTP), 80(HTTP) and 443(HTTPS).

  sudo ufw allow 21/tcp
  sudo ufw allow 80/tcp
  sudo ufw allow 443/tcp
  

• Allow Specific Services – UFW uses /etc/services files to get port of specific service, So we can allow any service with name instead of defining port. Like ftp (21), http(80).

  sudo ufw allow ftp/tcp
  sudo ufw allow http/tcp
  sudo ufw allow https/tcp
  

• Allow Port Range – We can also allow range of ports in single command like:

  sudo ufw allow 1100-1200/tcp
  

• Allow Access to Specific IP – To allow connections from specific ip address use following command.

  sudo ufw allow from 192.168.1.100
  

• Allow Access to Subnet – To allow connections from any ip address of subnet use following command.

  sudo ufw allow from 192.168.1.0/24
  

• Allow IP to Specific Port – To allow connections from any ip address of subnet use following command.

  sudo ufw allow from 192.168.1.100 to any port 22
  

Deny Connections with UFW

• Deny Specific Ports – To allow a single port, for example allow port 21(FTP), 80(HTTP) and 443(HTTPS).

  sudo ufw deny 21/tcp
  sudo ufw deny 80/tcp
  sudo ufw deny 443/tcp
  

• Deny Port Range – We can also allow range of ports in single command like:

  sudo ufw deny 1100-1200/tcp
  

• Deny Access to Specific IP – To deny connections from specific ip address use following command.

  sudo ufw deny from 192.168.1.100
  

• Deny Access to Subnet – To deny connections from any ip address of subnet use following command.

  sudo ufw deny from 192.168.1.0/24
  

• Deny IP to Specific Port -To deny connections from any ip address of subnet use following command.

  sudo ufw allow from 192.168.1.100 to any port 22
  

Enable or Disable Logging

UFW created logs for all filtered connections in /var/log/ufw.log file. It can be helpful for troubleshooting Use below to enable or disable logging.

Enable logging:

sudo ufw logging on

Disable logging:

sudo ufw logging off

Reference: https://wiki.ubuntu.com/UncomplicatedFirewall