Essential UFW Commands and Their Usage

UFW (Uncomplicated Firewall) is a powerful tool designed to simplify the management of firewall rules on Linux systems. It provides a user-friendly interface for configuring iptables, making it accessible even to those with limited networking experience.

This tutorial will cover UFW essentials—common firewall rules and commands with their usage and examples, helping you secure your system effectively.

Installing UFW:

Before you start using UFW, you need to ensure it is installed on your system.

Most Debian and Debian-based distributions like Ubuntu come with UFW pre-installed. If not, you can install it using the following command:

sudo apt update
sudo apt install ufw

Enabling and disabling the UFW:

To start using UFW, you first need to enable it; this activates the firewall with the default settings, which is block everything or don’t allow anything as per my server stack.

Enable UFW:

sudo ufw enable

If you need to temporarily disable UFW, you can do so with the following command:

Disable UFW:

sudo ufw disable

Once disabled, UFW will remain inactive unless manually enabled again.

Checking UFW status:

You can check the current status of UFW to see if it is active and what rules are currently applied. You can even see things in detail (wordy mode) by using verbose option.

Check UFW Status:

sudo ufw status

For a more detailed output, you can use:

sudo ufw status verbose

Basic UFW Commands:

UFW uses simple syntax to allow or deny traffic.

Here are some basic commands:

Allow a service:

sudo ufw allow ssh

This command allows incoming SSH connections.

UFW has predefined profiles for common services like SSH, HTTP, and HTTPS.

Deny a service:

sudo ufw deny http

This command blocks incoming HTTP traffic.

Allow a port:

sudo ufw allow 8080

This command allows traffic on port 8080.

You can specify both TCP and UDP protocols if needed.

Deny a port:

sudo ufw deny 23

This command blocks traffic on port 23.

Advanced UFW commands:

For more granular control, UFW allows you to specify protocols, IP addresses, and ranges.

Allow specific IP address:

sudo ufw allow from 192.168.1.100

This command allows traffic from the IP address 192.168.1.100.

Deny specific IP address:

sudo ufw deny from 192.168.1.200

This command blocks traffic from the IP address 192.168.1.200.

Allow IP address on specific port:

sudo ufw allow from 192.168.1.100 to any port 22

This command allows traffic from 192.168.1.100 to port 22.

Deny IP address on specific port:

sudo ufw deny from 192.168.1.200 to any port 80

This command blocks traffic from 192.168.1.200 to port 80.

Using UFW with application profiles:

Many applications provide UFW profiles that make it easy to allow or deny traffic for those applications.

List of Available application profiles:

sudo ufw app list

Allow application profile:

sudo ufw allow 'Apache Full'

sudo ufw allow 'Nginx Full'

This command allows traffic for the Apache Full profile, which typically includes both HTTP and HTTPS. Similarly, Nginx web server users can use Nginx Full profile. I have included command for both web servers, as some uses Apache and some Nginx.

Most admins like this application profile feature because they have to worry less about what specific port they need to control in order to allow an application.

Logging and monitoring:

UFW supports logging, which is useful for monitoring and troubleshooting.

Enable UFW logging:

sudo ufw logging on

Disable UFW logging:

sudo ufw logging off

Set logging level:

sudo ufw logging low

UFW supports different logging levels: off, low, medium, high, and full.

Adjust the logging level according to your needs; and do note that logging is a burden on disk, and old hardware (HDD) often show some sluggishness in high level logging. But if you have decent hardware and fast disk, nothing is going to affect.

Managing UFW rules:

As you add and remove rules, it’s important to manage them effectively.

Delete a rule by number:

sudo ufw status numbered

This command lists rules with numbers. To delete a rule, use the following syntax:

sudo ufw delete [number]

Replace [number] with the actual rule number.

Reset UFW:

sudo ufw reset

This command resets UFW to its default state, removing all rules.

Best practices for using UFW:

1. Start with default deny: It’s a good practice to start with a default deny policy and then allow specific traffic. Because all rules work in set orders.

sudo ufw default deny incoming
sudo ufw default allow outgoing

2. Allow necessary services: Only allow the services you need. For example, for a web server, you might allow HTTP, HTTPS, and SSH.
3. Regularly review rules: Periodically check and review your firewall rules to ensure they are still relevant and necessary.
4. Use logging: Enable logging to keep track of blocked attempts and unusual traffic patterns.

Conclusion.

UFW is a powerful yet user-friendly tool for managing firewall rules on Debian-based systems. By understanding and utilizing the essential UFW commands covered in this tutorial, you can significantly enhance the security of your Linux server.

Regularly review and update your firewall rules to ensure your system remains protected against unauthorized access and potential threats.