UFW or Uncomplicated Firewall is Ubuntu’s twist on the old faithful iptables.  Personally being an old hat I was very happy with iptables.  It worked well and I was proficient enough to write rules on the fly. UFW was built to be a “user friendly” front end for iptables as was Firewalld.  There are some things you will need to know right off the bat if you are used to iptables. In this article we will show you all the basics you need to get started with Uncomplicated Firewall.

How to Save Rules in Uncomplicated Firewall

Iptables rules are effective as soon as you hit enter, but they are not persistent.  Meaning they will not survive a reboot or a restart.  With UFW the rules are effective immediately also, but they are also saved.  This took me a minute to figure out.  Short story… No need for a save command.

I spent some time searching for the above information, so I figured I would put that front and center.  Now let’s hit some basics.

Installing Uncomplicated Firewall

First you will want to ensure UFW is installed.

sudo apt-get install ufw

By default UFW is set to deny all incoming connections, and allow all outgoing connections.

Checking UFW status and Listing UFW rules

Simple, ask…

sudo ufw status

The status will be either active or disabled.

The above command will also list any rules you have set.

NOTE: You can also add verbose for more information.

sudo ufw status verbose

You can also list them numbered.  This comes in handy if you have a large amount of rules.

sudo ufw status numbered

Setting UFW default policy

UFW (and iptables) uses “default policies” to act on traffic that is not explicitly called out by a rule.  As a connection request comes in, UFW will check the rules sequentially and if it does not match a rule, it will use the action specified in the default policy.

You can set the default policy to deny incoming traffic like so:

sudo ufw default deny incoming

and allow outgoing traffic like so:

sudo ufw default allow outgoing

Open a specific port on UFW

If you want to open a specific port, say port 22/SSH, it’s simple.  We will add the SSH port first before enabling UFW to ensure we do not get locked out of our system.

sudo ufw allow 22

or

sudo ufw allow ssh

Enabling or Disabling UFW

Once you are sure you have SSH open, you can go ahead and enable UFW.NOTE: You will see a warning about disrupting SSH connections.  If you set the 22/SSH port rule above, you will be fine.  If not you run the chance of being locked out.

sudo ufw enable

Disable is similar….

sudo ufw disable

Now let’s move on to more interesting configurations.

Opening up a specific port range in UFW

Often it is necessary to open a port range.  For example 137-138 for Samba.  You can use the colon to specify port ranges like so:

sudo ufw allow 137:138/udp

NOTE: When specifying port ranges, you MUST include the protocol.  In this case Samba using 137/138 UDP.

Allowing a connection from a specific host in UFW

You can specific a host that is allowed to connect to your system by IP address like so:

sudo ufw allow from 10.0.0.10

Allowing a connection from specific host on specific port

You can mix and match these rules (port, host, protocol, interface, etc..)

If you want to allow only one specific host to SSH to your system you can do that like so:

sudo ufw allow from 10.0.0.10 to any port 22

Allowing a connection over a specific network interface in UFW

You may want to limit some traffic to a specific network interface, maybe a management interface?  To restrict SSH traffic to the eth0 interface:

sudo ufw allow in on eth0 to any port 22

It is good security practice to make your rules as granular as possible.  To find the name of your network interface you can use the “ip addr” command.

Allowing connections from a specific network subnet

If you want to allow traffic from a specific subnet, just add the CIDR to the network address like so:

sudo ufw allow from 10.0.0.0/24

and limit that subnet to a specific port:

sudo ufw allow from 10.0.0.0/24 to any port 22

Limit that subnet to a specific port on a specific interface:

sudo ufw allow in on eth0 from 10.0.0.0/24 to any port 22

(See where we are going with this?)

Denying specific traffic in UFW

All of the above “allow” commands can be changed to deny command simply by changing the word allow to deny like so:

Deny traffic from 10.0.0.0/24 subnet:

sudo ufw deny from 10.0.0.0/24

Deny Traffic on port 80:

sudo ufw deny 80

or

sudo ufw deny http

Deleting Firewall Rules with UFW

You can delete rules by either specifying the number of the rule (view numbered) or typing out the specific rule.

For example, let’s say you wanted to close up port 443:

sudo ufw delete allow 443

You can also use the number of the rule in the chain.  We briefly covered using the numbered option above, but here is an example:

savona@biguntu:~$ sudo ufw status numbered verbose
Status: active
     To                         Action      From
     —                         ——      —-
[ 1] 22                         ALLOW IN    Anywhere
[ 2] 137/udp                    ALLOW IN    10.0.0.3
[ 3] 138/udp                    ALLOW IN    10.0.0.3
[ 4] 139/tcp                    ALLOW IN    10.0.0.3
[ 5] 445/tcp                    ALLOW IN    10.0.0.3
[ 6] 22 on enp7s0               ALLOW IN    10.0.0.0/24

Now you can delete the firewall rule using the number, like so:

savona@biguntu:~$ sudo ufw delete 6
Deleting:
 allow in on enp7s0 from 10.0.0.0/24 to any port 22
Proceed with operation (y|n)? y
Rule deleted

Disabling and resetting Uncomplicated Firewall

You can disable UFW simply by giving it the disable command:

sudo ufw disable

NOTE: Disabling UFW will not delete the rules, if you re-enable it, the rules you set will still be there. Disabling UFW would be handy for testing connection issue to rule out the firewall.

You can also reset UFW.  Resetting UFW will delete all the rules and disable the firewall.  This will not effect default policies.

sudo ufw reset

Conclusion

Now you should have a good understanding of the basic of UFW.  Uncomplicated firewall simplified the administration of iptables a fair amount. Of course being an old hat, I still prefer iptables, respect UFW and I am just getting my head around firewalld basics.