Simplify your firewall setup
Fire Protection
Canonical's ufw lets you configure your firewall without the hassle of the iptables tool, while reducing the risk of misconfiguration and simplifying maintenance.
The netfilter firewall included in the Linux kernel can be comprehensively controlled with the iptables tool. However, iptables' complexity not only drives some users crazy, it also increases the risk of unintentionally tearing holes in the firewall with incorrect rules or typos.
Canonical offers a remedy with the Uncomplicated Firewall (ufw) [1]. The command-line program accepts clearly structured rules, which it translates into the appropriate iptables calls in the background. This approach also allows you the advantage of supplementing your setup with more complex rules in iptables, if needed.
Installation
Originally developed by Canonical for Ubuntu, ufw has been part of the distribution since Ubuntu 8.04. Alternately, you can install it with the ufw package. You can also now find ufw on other distributions.
If your distribution's repositories do not contain ufw, you can pick up the source code online [2]. To get started, ufw requires Python v3.4 or later, iptables 1.4 or later, gettext
, and make
. After unpacking the source code archive, just call
python3 ./setup.py install
with root privileges for a global installation. To start the firewall at boot time, integrate the command
/lib/ufw/ufw-init start
into the respective start scripts. An example unit for systemd is available in the source code archive in doc/systemd.example
.
If you also want to regulate IPv6 traffic, open the configuration file located in /etc/default/ufw
and make sure it contains a line stating IPV6=yes
. In this article, all examples use IPv4 addresses, but the commands will also work with IPv6.
Blockade
Before getting started, check whether the firewall is running with:
sudo ufw status
If a status: inactive
message appears, launch ufw by typing
sudo ufw enable
This command also ensures that the firewall starts up automatically at boot time. If necessary, you can disable it again at any time with:
sudo ufw disable
By default, ufw blocks all incoming requests and allows all outgoing messages from the machine to pass. This prevents attackers in particular from reaching any service on the corresponding system. At the same time, the behavior gives you a safety net that catches everything; unless another rule says otherwise, ufw applies the default rules. For example, if you do not define a rule for SSH access, ufw automatically blocks access from outside based on the default rules.
You can change the default behavior with the two commands shown in Listing 1. The first line takes care of all incoming connections, while the second line is for outgoing connections; deny
prohibits access, while allow
permits it. Consequently, the two commands ensure the default behavior. If you were to replace allow
with deny
in the second line of Listing 1, ufw would automatically prohibit all network traffic.
Listing 1
Connections
$ sudo ufw default deny incoming $ sudo ufw default allow outgoing
Like all other commands, the two commands in Listing 1 are intuitive. Even without knowledge of the individual parameters, you can decipher what the command does. Ufw uses its own syntax, which is based on the OpenBSD PF firewall's syntax. If you have previously worked with other tools like iptables, you will need to learn ufw's syntax.
Regulators
Ufw lets you drill holes in the firewall in a targeted way. To do this, specify the appropriate service after the following command:
sudo ufw allow
For instance, the command shown in Figure 1

sudo ufw allow ssh
allows SSH connections from the outside. Repeat this step for all other services you want to allow. For example,
sudo ufw allow http
allows access to an HTTP browser via port 80. All supported names and services can be found in the /etc/services
file.
In addition, ufw also understands the names of some applications. For example,
sudo ufw allow 'CUPS'
sets up custom rules for the CUPS printing system. To determine which application names a system currently supports, use:
sudo ufw app list
On Ubuntu, the range of available applications depends largely on the installed services. For example, if the web server Nginx is not available on your system, ufw does not support it either.
If an application name contains spaces, such as Nginx Full, you will need to quote it in the ufw call, as shown in the CUPS example. Otherwise, the shell interprets the words in the name as individual parameters. It is a good idea to get into the habit of always enclosing application names in quotes.
An application's rules are defined by an application profile (Figure 2). All existing profiles are grouped in the directory /etc/ufw/applications.d/
. The files in this directory can be used as a basis for your own application profiles; its structure is self-explanatory.

When creating a firewall rule, you can also specify the port directly. For SSH, for example, you would specify the port as follows:
sudo ufw allow 22
Ufw then automatically sets up matching rules for the TCP and UDP protocols. To allow only a specific protocol, append it to the port number with a forward slash (22/tcp
). Complete port ranges can also be stored. For example,
sudo ufw allow 8080:8082/tcp
opens ports 8080, 8081, and 8082 for incoming TCP connections.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you've found an article to be beneficial.
News
-
Fedora 39 Beta is Now Available for Testing
For fans and users of Fedora Linux, the first beta of release 39 is now available, which is a minor upgrade but does include GNOME 45.
-
Fedora Linux 40 to Drop X11 for KDE Plasma
When Fedora 40 arrives in 2024, there will be a few big changes coming, especially for the KDE Plasma option.
-
Real-Time Ubuntu Available in AWS Marketplace
Anyone looking for a Linux distribution for real-time processing could do a whole lot worse than Real-Time Ubuntu.
-
KSMBD Finally Reaches a Stable State
For those who've been looking forward to the first release of KSMBD, after two years it's no longer considered experimental.
-
Nitrux 3.0.0 Has Been Released
The latest version of Nitrux brings plenty of innovation and fresh apps to the table.
-
Linux From Scratch 12.0 Now Available
If you're looking to roll your own Linux distribution, the latest version of Linux From Scratch is now available with plenty of updates.
-
Linux Kernel 6.5 Has Been Released
The newest Linux kernel, version 6.5, now includes initial support for two very exciting features.
-
UbuntuDDE 23.04 Now Available
A new version of the UbuntuDDE remix has finally arrived with all the updates from the Deepin desktop and everything that comes with the Ubuntu 23.04 base.
-
Star Labs Reveals a New Surface-Like Linux Tablet
If you've ever wanted a tablet that rivals the MS Surface, you're in luck as Star Labs has created such a device.
-
SUSE Going Private (Again)
The company behind SUSE Linux Enterprise, Rancher, and NeuVector recently announced that Marcel LUX III SARL (Marcel), its majority shareholder, intends to delist it from the Frankfurt Stock Exchange by way of a merger.