Setting Up a Firewall with UFW on Ubuntu

UFW (Uncomplicated Firewall) is a tool built on top of the Linux kernel’s packet filtering that simplifies the process of setting up a firewall. In this guide, you’ll learn how to configure a firewall using UFW on Ubuntu 18.04 and later versions.

Prerequisites

To get started, you’ll need an Ubuntu server with sudo privileges. UFW is installed by default on Ubuntu, but if it’s not installed, you can do so with the following command:

sudo apt install ufw

Step 1: Enabling IPv6

First, ensure that IPv6 is enabled. Open the /etc/default/ufw file:

sudo nano /etc/default/ufw

Make sure the following line is set to yes:

IPV6=yes

This setting allows UFW to generate both IPv4 and IPv6 firewall rules.

Step 2: Setting Default Policies

By default, UFW denies all incoming connections and allows all outgoing connections. Set these default policies with the following commands:

sudo ufw default deny incoming
sudo ufw default allow outgoing

Step 3: Allowing SSH Connections

Before enabling the firewall, ensure that SSH connections are allowed so you don’t lose access to your server:

sudo ufw allow ssh

Alternatively, you can allow SSH by specifying the port number:

sudo ufw allow 22/tcp

If your SSH service runs on a different port, specify that port:

sudo ufw allow 2222/tcp

Step 4: Enabling UFW

After allowing SSH connections, you can enable UFW:

sudo ufw enable

Once the firewall is enabled, check its status with:

sudo ufw status verbose

Step 5: Allowing Other Connections

Next, allow other connections that your server needs to function. For example:

• HTTP (Port 80):

sudo ufw allow http
sudo ufw allow 80

• HTTPS (Port 443):

sudo ufw allow https
sudo ufw allow 443

• Apache (for both HTTP and HTTPS):

sudo ufw allow 'Apache Full'

• Nginx (for both HTTP and HTTPS):

sudo ufw allow 'Nginx Full'

Step 6: Allowing Specific IP Addresses and Ranges

To allow connections from a specific IP address:

sudo ufw allow from 203.0.113.10

To allow a specific port for an IP address:

sudo ufw allow from 203.0.113.10 to any port 22 proto tcp

To allow a range of IP addresses using CIDR notation:

sudo ufw allow from 198.51.100.0/24

Step 7: Denying Connections

To deny specific connections, use the deny command. For example, to deny HTTP connections:

sudo ufw deny http

To deny all connections from a specific IP address:

sudo ufw deny from 203.0.113.10

If you need to block outgoing connections, use:

sudo ufw deny out 25

Step 8: Deleting Rules

To delete rules in UFW, you can use the following commands:

• To delete by rule number, first list the rules with numbers:

sudo ufw status numbered

Then, delete the desired rule with:

sudo ufw delete 2

• To delete a rule by name:

sudo ufw delete allow http

Step 9: Disabling or Resetting UFW

If you need to disable UFW:

sudo ufw disable

Resetting UFW disables it and removes all rules. Record the existing rules first and make sure you can recover from a console if needed:

sudo ufw reset

Conclusion

Use sudo ufw status verbose to check what is allowed and verify access from a second SSH session before closing your first one. Be sure to allow necessary connections while blocking unnecessary ones to keep your server secure and functional.