Setting up a firewall with UFW Ubuntu

UFW (Uncomplicated Firewall) is an interface for iptables designed to simplify the firewall configuration process. Installation

apt install ufw

nano /etc/default/ufw


IPV6=no

Save and close the file. After activating UFW, it will be configured to record firewall rules for IPv4.

By default, UFW is set to deny all incoming connections and allow all outgoing connections. This means that any attempts to contact your server will be blocked, but any applications on your server will have connectivity to the external world. Let's restore the default UFW rules to continue with this tutorial.

ufw default deny incoming
ufw default allow outgoing

These commands set the default values, denying incoming connections and allowing outgoing ones.

If we activate the UFW firewall now, all incoming connections will be denied. This means that we need to create rules that explicitly allow legitimate incoming connections (e.g., SSH or HTTP). For example, SSH:

ufw allow ssh

This command will create firewall rules that allow all connections on port 22, which is the default port that the SSH daemon listens on. UFW knows which port is meant by the "allow ssh" command because it is specified as a service in the /etc/services file. If you've configured the SSH daemon to use a different port, you'll need to specify the corresponding port.

ufw allow 2222

Let's consider the http port as an example:

ufw allow http

or

ufw allow 80

The https port:

ufw allow https

or

ufw allow 443

Certain port ranges, such as passive mode FTP.

ufw allow 65000:66000/tcp

When specifying port ranges with UFW, you must specify the protocol (tcp or udp) to which these rules should apply. Specific IP addresses: When working with UFW, you can also specify specific IP addresses. For example, if you want to allow connections from a specific IP address, such as a work or home address

ufw allow from 122.122.122.122

Or for example to a specific port

ufw allow from 122.122.122.122 to any port 80

If you haven't changed the default policy for incoming connections, UFW is set to deny all incoming connections. This simplifies the process of creating a secure firewall policy since you need to create rules that explicitly allow connections through specific ports and IP addresses. However, in some cases, you may need to block certain connections based on the source IP address or subnet, for instance, in the case of an attack from a specific address. For example, to block connections to the HTTP protocol, you can use the following command:

ufw deny http

or

ufw deny from 122.122.122.122

It's also possible to set up protection against

There are two different ways to specify rules for removal: by rule number or by the actual rule. By rule number: To get the list of rules

ufw status numbered

Numbered Output:
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22                         ALLOW IN    1.1.1.1/23
[ 2] 443                        ALLOW IN    Anywhere

Remove rule 2

ufw delete 2

By the actual rule name:

ufw delete allow https

or

ufw delete allow 80

ufw status verbose

If UFW is disabled (by default), you will see something like this:

Output
Status: inactive

When it's active, you will see the list of rules.

ufw disable