Simplify your firewall setup
Fire Protection
Canonical's ufw lets you configure your firewall without the hassle of the iptables tool, while reducing the risk of misconfiguration and simplifying maintenance.
The netfilter firewall included in the Linux kernel can be comprehensively controlled with the iptables tool. However, iptables' complexity not only drives some users crazy, it also increases the risk of unintentionally tearing holes in the firewall with incorrect rules or typos.
Canonical offers a remedy with the Uncomplicated Firewall (ufw) [1]. The command-line program accepts clearly structured rules, which it translates into the appropriate iptables calls in the background. This approach also allows you the advantage of supplementing your setup with more complex rules in iptables, if needed.
Installation
Originally developed by Canonical for Ubuntu, ufw has been part of the distribution since Ubuntu 8.04. Alternately, you can install it with the ufw package. You can also now find ufw on other distributions.
If your distribution's repositories do not contain ufw, you can pick up the source code online [2]. To get started, ufw requires Python v3.4 or later, iptables 1.4 or later, gettext
, and make
. After unpacking the source code archive, just call
python3 ./setup.py install
with root privileges for a global installation. To start the firewall at boot time, integrate the command
/lib/ufw/ufw-init start
into the respective start scripts. An example unit for systemd is available in the source code archive in doc/systemd.example
.
If you also want to regulate IPv6 traffic, open the configuration file located in /etc/default/ufw
and make sure it contains a line stating IPV6=yes
. In this article, all examples use IPv4 addresses, but the commands will also work with IPv6.
Blockade
Before getting started, check whether the firewall is running with:
sudo ufw status
If a status: inactive
message appears, launch ufw by typing
sudo ufw enable
This command also ensures that the firewall starts up automatically at boot time. If necessary, you can disable it again at any time with:
sudo ufw disable
By default, ufw blocks all incoming requests and allows all outgoing messages from the machine to pass. This prevents attackers in particular from reaching any service on the corresponding system. At the same time, the behavior gives you a safety net that catches everything; unless another rule says otherwise, ufw applies the default rules. For example, if you do not define a rule for SSH access, ufw automatically blocks access from outside based on the default rules.
You can change the default behavior with the two commands shown in Listing 1. The first line takes care of all incoming connections, while the second line is for outgoing connections; deny
prohibits access, while allow
permits it. Consequently, the two commands ensure the default behavior. If you were to replace allow
with deny
in the second line of Listing 1, ufw would automatically prohibit all network traffic.
Listing 1
Connections
$ sudo ufw default deny incoming $ sudo ufw default allow outgoing
Like all other commands, the two commands in Listing 1 are intuitive. Even without knowledge of the individual parameters, you can decipher what the command does. Ufw uses its own syntax, which is based on the OpenBSD PF firewall's syntax. If you have previously worked with other tools like iptables, you will need to learn ufw's syntax.
Regulators
Ufw lets you drill holes in the firewall in a targeted way. To do this, specify the appropriate service after the following command:
sudo ufw allow
For instance, the command shown in Figure 1

sudo ufw allow ssh
allows SSH connections from the outside. Repeat this step for all other services you want to allow. For example,
sudo ufw allow http
allows access to an HTTP browser via port 80. All supported names and services can be found in the /etc/services
file.
In addition, ufw also understands the names of some applications. For example,
sudo ufw allow 'CUPS'
sets up custom rules for the CUPS printing system. To determine which application names a system currently supports, use:
sudo ufw app list
On Ubuntu, the range of available applications depends largely on the installed services. For example, if the web server Nginx is not available on your system, ufw does not support it either.
If an application name contains spaces, such as Nginx Full, you will need to quote it in the ufw call, as shown in the CUPS example. Otherwise, the shell interprets the words in the name as individual parameters. It is a good idea to get into the habit of always enclosing application names in quotes.
An application's rules are defined by an application profile (Figure 2). All existing profiles are grouped in the directory /etc/ufw/applications.d/
. The files in this directory can be used as a basis for your own application profiles; its structure is self-explanatory.

When creating a firewall rule, you can also specify the port directly. For SSH, for example, you would specify the port as follows:
sudo ufw allow 22
Ufw then automatically sets up matching rules for the TCP and UDP protocols. To allow only a specific protocol, append it to the port number with a forward slash (22/tcp
). Complete port ranges can also be stored. For example,
sudo ufw allow 8080:8082/tcp
opens ports 8080, 8081, and 8082 for incoming TCP connections.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Direct Download
Read full article as PDF:
Price $2.95
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Find SysAdmin Jobs
News
-
KDE Plasma 5.27 Beta is Ready for Testing
The latest beta iteration of the KDE Plasma desktop is now available and includes some important additions and fixes.
-
Netrunner OS 23 Is Now Available
The latest version of this Linux distribution is now based on Debian Bullseye and is ready for installation and finally hits the KDE 5.20 branch of the desktop.
-
New Linux Distribution Built for Gamers
With a Gnome desktop that offers different layouts and a custom kernel, PikaOS is a great option for gamers of all types.
-
System76 Beefs Up Popular Pangolin Laptop
The darling of open-source-powered laptops and desktops will soon drop a new AMD Ryzen 7-powered version of their popular Pangolin laptop.
-
Nobara Project Is a Modified Version of Fedora with User-Friendly Fixes
If you're looking for a version of Fedora that includes third-party and proprietary packages, look no further than the Nobara Project.
-
Gnome 44 Now Has a Release Date
Gnome 44 will be officially released on March 22, 2023.
-
Nitrux 2.6 Available with Kernel 6.1 and a Major Change
The developers of Nitrux have officially released version 2.6 of their Linux distribution with plenty of new features to excite users.
-
Vanilla OS Initial Release Is Now Available
A stock GNOME experience with on-demand immutability finally sees its first production release.
-
Critical Linux Vulnerability Found to Impact SMB Servers
A Linux vulnerability with a CVSS score of 10 has been found to affect SMB servers and can lead to remote code execution.
-
Linux Mint 21.1 Now Available with Plenty of Look and Feel Changes
Vera has arrived and although it is still using kernel 5.15, there are plenty of improvements sure to please everyone.