A firewall is a network of security controls that dictates and filters traffic depending on the set rules. In simple words, it protects the system against unwanted traffic from outside. Depending on the defined firewall rules, the traffic can be blocked or allowed through.
The Linux kernel ships a subsystem known as the Netfilter. It is responsible for deciding and manipulating the network traffic that goes in and out of the server. All the modern solutions of the Linux firewall utilize this system for packet filtering. This packet filtering system can be of very little use if no user manages it. This is where Iptables come in. When a packet reaches the system, it is handled by the Netfilter subsystem, which decides whether to accept, manipulate or reject it based on the rules supplied to it by the user via the iptables. Therefore, system admins and Linux professionals need iptables to manage their firewalls. To make it easier, there are many front-end tools that can be used to simplify this task. Some of these tools include Shorewall, Firewalld, ufw, nftables, gufw etc.
Uncomplicated Firewall abbreviated as ufw is the default firewall configuration tool for Debian-based systems. This tool runs on top of iptables to simplify firewall configuration. It provides a simple and user-friendly way to create both IPv4 and IPv6 host-based firewall rules. Although UFW doesn’t provide full firewall functionality via its CLI, it can still be used to add and remove simple host-based rules.
Below is a cheat sheet can captures all the common UFW Firewall commands with examples. This can serve as a quick reference material for system admins who want to quickly configure firewall rules on their system.
Install UFW on Your Linux System
UFW is common on Debian-based systems. However, this tool can still be installed and used on any other Linux system. The below commands can be used to install UFW on Linux.
##On debian-based Systems
sudo apt update
sudo apt install ufw
##On RHEL-based Systems
sudo yum install epel-release
sudo yum install ufw
##On Fedora
sudo dnf install ufw
##On OpenSuse
sudo zypper install ufw
##On Arch Linux
sudo pacman -S ufw
##On Alpine Linux
sudo apk add ufwVerify the installation using:
$ ufw version
ufw 0.35
Copyright 2008-2015 Canonical Ltd.1.1. Start, Enable/Disable UFW
Once installed, ensure the service is started and enabled:
sudo systemctl enable --now ufwCheck the status of the service:
$ systemctl status ufw
● ufw.service - Uncomplicated firewall
Loaded: loaded (/usr/lib/systemd/system/ufw.service; enabled; vendor preset: disabled)
Active: active (exited) since Sun 2023-09-17 11:20:36 CEST; 4s ago
Docs: man:ufw(8)
man:ufw-framework(8)
file://usr/share/doc/ufw/README
Process: 72156 ExecStart=/usr/libexec/ufw/ufw-init start (code=exited, status=0/SUCCESS)
Main PID: 72156 (code=exited, status=0/SUCCESS)
CPU: 80msYou can also check the status with the command:
$ sudo ufw status
Status: active
To Action From
-- ------ ----
SSH ALLOW Anywhere
224.0.0.251 mDNS ALLOW Anywhere
SSH (v6) ALLOW Anywhere (v6)
ff02::fb mDNS ALLOW Anywhere (v6) If not active, enable it with:
$ sudo ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startupTo disable it, use:
sudo ufw disableCommon UFW Firewall Commands with Examples
Once installed and activated, you can use UFW to set the desired firewall rules on your system. Below are the common commands included.
2.1. Block IP Addresses
UFW allows users to create a rule that blocks all the connections that come from a specific IP address. To deny traffic from a specific address, use the command with the below syntax:
sudo ufw deny from <IP_Address>In the command, you need to replace your IP address correctly. For example:
$ sudo ufw deny from 192.168.200.51
Rule addedIn the above command, we have set the system to drop all the connections from the source 192.168.200.51. To check the added rule, run:
$ sudo ufw status
To Action From
-- ------ ----
224.0.0.251 mDNS ALLOW Anywhere
Anywhere DENY 192.168.200.51 2.2. Block a Subnet
Aside from blocking a single IP address, you can also block an entire subnet. To achieve that, you use the command with the syntax:
sudo ufw deny from <subnet>For example:
$ sudo ufw deny from 192.168.200.0/24
Rule added2.3. Block a Network Interface
You can block incoming connections from an IP address or subnet to a specific network interface. To achieve that, use the command:
sudo ufw deny in on <interface_name> from <IP_Address>For example:
$ sudo ufw deny in on eth0 from 192.168.200.51
Rule added2.4. Allow IP address/Network Interface
To allow traffic from a specific address, you can use the below command, replacing values where required.
sudo ufw allow from <IP_Address>For example:
sudo ufw allow from 192.168.200.59View the rule:
$ sudo ufw status
Status: active
To Action From
-- ------ ----
224.0.0.251 mDNS ALLOW Anywhere
Anywhere DENY 192.168.200.51
Anywhere on eth0 DENY 192.168.200.51
Anywhere on ens18 DENY 192.168.200.51
22 ALLOW Anywhere
Anywhere ALLOW 192.168.200.59
SSH (v6) ALLOW Anywhere (v6)
ff02::fb mDNS ALLOW Anywhere (v6)
22 (v6) ALLOW Anywhere (v6) To allow incoming traffic from an IP on a specific interface use:
sudo ufw allow in on <interface_name> from <IP_Address>For instance:
$ sudo ufw allow in on eth0 from 192.168.200.51
Rule updated2.5. Enable/Disable Application Profile
UFW allows users to block or allow traffic from an application. To view the list of the available application profiles, use:
$ sudo ufw app list
Available applications:
AIM
Bonjour
CIFS
DNS
Deluge
IMAP
IMAPS
IPP
Icecream
KDE Connect
KTorrent
Kerberos Admin
Kerberos Full
Kerberos KDC
Kerberos Password
LDAP
LDAPS
LPD
MSN
MSN SSL
Mail submission
NFS
POP3
POP3S
PeopleNearby
SMTP
SSH
......You can also filter a given app for example Nginx:
$ sudo ufw app list | grep Nginx
Nginx Full
Nginx HTTP
Nginx HTTPSTo enable an application pforiles, you need to provide the name of the application profile in the command:
sudo ufw allow “<application_profile>”For example:
$ sudo ufw allow "OpenSSH"
ufw allow "OpenSSH"
Rules updated
Rules updated (v6)To view the enabled profiles, run:
$ sudo ufw status
Status: active
To Action From
-- ------ ----
5432/tcp ALLOW Anywhere
OpenSSH ALLOW Anywhere
5432/tcp (v6) ALLOW Anywhere (v6)
OpenSSH (v6) ALLOW Anywhere (v6) To desable an app profile, use the below command replacing variables where required:
sudo ufw delete allow "<application_profile>”For example, Nginx has two profiles, Nginx Full which allows both HTTP and HTTPS connection and Nginx HTTPS which allows HTTPS connections only. We can disable the enabled Nginx Full profile and enable the HTTPS profile only with the commands:
##Disable the Nginx Full profile
sudo ufw delete allow "Nginx Full"
##Enable Nginx HTTPs
sudo ufw allow "Nginx HTTPS"2.6. Allow/Block traffic on a Port
Aside from enabling/disabling the app profile, UFW allows you to block/allow traffic to a specific port. The command used for that has the below syntax:
sudo ufw allow <port_number>For example:
sudo ufw allow 80You can also the service name. For example:
##For HTTP
sudo ufw allow http
##For HTTPS
sudo ufw allow httpsTo deny any outgoing traffic on a port, use:
sudo ufw deny out <port_number>For example, dropping all the outgoing traffic on port 25 for SMTP, use:
sudo ufw deny out 25You can deny traffic from a specific address on a given port using:
sudo ufw deny from <ip address> to <protocol> port <port number>For example:
sudo ufw deny from 192.168.20.51 to any port 33062.7. Allow traffic on Port from a specific Addresss
It is also possible to allow traffic on a port form a specific address. For that case, you will have the command as:
##From IP address
sudo ufw allow from <IP_Address> proto tcp to any port <port_number>
##Form subnet
sudo ufw allow from <subnet> proto tcp to any port <port_number>For example, allowing SSH from a specific Address, you will have the command as:
sudo ufw allow from 192.168.200.51 proto tcp to any port 22To allow MySQL connection from a specific subnet:
sudo ufw allow from 192.168.200.0/24 proto tcp to any port 33062.8. How to delete a Rule
There are scenarios when you need to delete a set fireall rule on UFW. To achieve that, begin by listing the available rules:
$ sudo ufw status numbered
Status: active
To Action From
-- ------ ----
[ 1] 5432/tcp ALLOW IN Anywhere
[ 2] OpenSSH ALLOW IN Anywhere
[ 3] Nginx HTTPS ALLOW IN Anywhere
[ 4] 80 ALLOW IN Anywhere
[ 5] 80/tcp ALLOW IN Anywhere
[ 6] 25 DENY OUT Anywhere (out)
[ 7] 3306 DENY IN 192.168.20.51
[ 8] 3306/tcp ALLOW IN 192.168.200.0/24
[ 9] Anywhere ALLOW IN 192.168.200.51
[10] 5432/tcp (v6) ALLOW IN Anywhere (v6)
[11] OpenSSH (v6) ALLOW IN Anywhere (v6)
[12] Nginx HTTPS (v6) ALLOW IN Anywhere (v6)
[13] 80 (v6) ALLOW IN Anywhere (v6)
[14] 80/tcp (v6) ALLOW IN Anywhere (v6)
[15] 25 (v6) DENY OUT Anywhere (v6) (out)To delete a desired rule, use the command with the below syntax
##Using the target specification
sudo ufw delete <action> from <target>
##Using the Rule number
sudo ufw delete <rule_number>For example, deleting the allow in rule from 192.168.200.51, the command will be:
sudo ufw delete allow from 192.168.200.51You can also delete the rule by providing its number. For example:
sudo ufw delete 9Verify the changes:
$ sudo ufw status
Status: active
To Action From
-- ------ ----
5432/tcp ALLOW Anywhere
OpenSSH ALLOW Anywhere
Nginx HTTPS ALLOW Anywhere
80 ALLOW Anywhere
80/tcp ALLOW Anywhere
3306 DENY 192.168.20.51
3306/tcp ALLOW 192.168.200.0/24
5432/tcp (v6) ALLOW Anywhere (v6)
OpenSSH (v6) ALLOW Anywhere (v6)
Nginx HTTPS (v6) ALLOW Anywhere (v6)
80 (v6) ALLOW Anywhere (v6)
80/tcp (v6) ALLOW Anywhere (v6)
25 DENY OUT Anywhere
25 (v6) DENY OUT Anywhere (v6)Conclusion
That marks the end of this guide on how to install and use UFW to configure the host-based firewall rules. This guide has only provides the basic and common commands used. To explore more, visit the UFW documentation page.
See more:
- How To open a port in Windows Server Firewall
- Install and Configure Firewalld on Debian
- Install and Use CSF Firewall on RHEL / CentOS
