Simplify your firewall setup
Fine Tuning
Ufw stores all the rules and enables them automatically after a system reboot. The IPv4 rules are stored in the /etc/ufw/user.rules
file, and the IPv6 counterparts in /etc/ufw/user6.rules
. After creating new rules, you should reload these files for safety purposes by typing:
sudo ufw reload
Based on the default rules, ufw allows all outgoing connections. To specifically deny a service access to the network, use deny
instead of allow
. In addition, use out
at the end of the line to indicate that the rule applies to outgoing connections. For example, to prohibit outgoing traffic on port 22, use:
sudo ufw deny out ssh
After issuing this command, the system can no longer contact another host via SSH. Rules for incoming connections are tagged in the same way with in
. In all the previous examples where this keyword is missing, ufw automatically assumes that the rule applies to incoming connections.
In addition to allow
and deny
, reject
signifies that the firewall does not simply ignore access attempts but also notifies the sender of the attempts. Also, comment
lets you attach a note to all rules (Listing 2, first line). Each rule always applies to all network interfaces. To restrict a rule to one interface, specify its name after in
or out
(Listing 2, second line).
Listing 2
Comments and Interfaces
$ sudo ufw reject out ssh comment 'no ssh access allowed' $ sudo ufw allow in on enp0s3 ssh
Bouncer
Access via SSH should only be allowed for defined hosts. To do this, first deny SSH access globally with
sudo ufw deny ssh
Since this is also the default setting, you can alternatively remove the rule
sudo ufw delete allow ssh
which deletes the allow ssh
rule. If you can't remember the rules, call
sudo ufw status verbose
In addition, each rule is internally given a sequential number, which can be displayed with:
sudo ufw status numbered
You can use these numbers to delete specific rules. For example, to remove the rule assigned the number 2, use:
sudo ufw delete 2
Now that access via SSH is generally blocked, the command shown in Listing 3 exclusively allows SSH access for the computer with the IP address 192.168.1.101. If you omit to any port 22
, the IP address is allowed to access all services. Similarly, you can use deny
to block specific requests from an IP address.
Listing 3
Unblocking
$ sudo ufw allow from 192.168.1.101 to any port 22
Numerous requests within a short time indicate an attack and can also overload the affected service. If so desired, ufw can detect this kind of access attempt and then block it specifically. Currently, however, this useful function only works with IPv4 connections. For example, the firewall monitors the SSH service with the command
sudo ufw limit ssh
and blocks access if there are too many requests in a short time.
Chatterbox
If you get tangled up in too many rules, use the following command to start over:
sudo ufw reset
When creating new rules, you can use various reports for help. Use
sudo ufw show listening
to return all services that are currently listening on any port. This helps you find applications that you didn't know were running or that shouldn't be running at all (Figure 3).
If you are familiar with iptables, you can take an in-depth look into the firewall's current configuration with:
sudo ufw show raw
Ufw stores detailed information about its work in a log, which you can enable with
sudo ufw logging on
and then view in /var/log/ufw.log
.
« Previous 1 2 3 Next »
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Gnome OS Transitioning Toward a General-Purpose Distro
If you're looking for the perfectly vanilla take on the Gnome desktop, Gnome OS might be for you.
-
Fedora 41 Released with New Features
If you're a Fedora fan or just looking for a Linux distribution to help you migrate from Windows, Fedora 41 might be just the ticket.
-
AlmaLinux OS Kitten 10 Gives Power Users a Sneak Preview
If you're looking to kick the tires of AlmaLinux's upstream version, the developers have a purrfect solution.
-
Gnome 47.1 Released with a Few Fixes
The latest release of the Gnome desktop is all about fixing a few nagging issues and not about bringing new features into the mix.
-
System76 Unveils an Ampere-Powered Thelio Desktop
If you're looking for a new desktop system for developing autonomous driving and software-defined vehicle solutions. System76 has you covered.
-
VirtualBox 7.1.4 Includes Initial Support for Linux kernel 6.12
The latest version of VirtualBox has arrived and it not only adds initial support for kernel 6.12 but another feature that will make using the virtual machine tool much easier.
-
New Slimbook EVO with Raw AMD Ryzen Power
If you're looking for serious power in a 14" ultrabook that is powered by Linux, Slimbook has just the thing for you.
-
The Gnome Foundation Struggling to Stay Afloat
The foundation behind the Gnome desktop environment is having to go through some serious belt-tightening due to continued financial problems.
-
Thousands of Linux Servers Infected with Stealth Malware Since 2021
Perfctl is capable of remaining undetected, which makes it dangerous and hard to mitigate.
-
Halcyon Creates Anti-Ransomware Protection for Linux
As more Linux systems are targeted by ransomware, Halcyon is stepping up its protection.