How-To: UFW

[cprofitt]

I looked for a current how-to for UFW and when I did not see one I wanted to add one.

(important note: UFW is not the firewall. UFW just configures your iptables)

in most cases I recommend doing the following immediately:

sudo ufw default deny
sudo ufw enable

Then fine tuning can start:

Some basic commands are:

Turn on the firewall

sudo ufw enable

Turn off the firewall

sudo ufw disable

To add deny rules:
blocking a port

sudo ufw deny port <port number>

blocking an ip address

sudo ufw deny from <ip address>

blocking a specific ip address and port

sudo ufw deny from <ipaddress> to port <port number>

advanced deny example for denying access from an ip address range 10.120.0.1 - 10.120.0.255 for SSH port 22

sudo ufw deny from 10.0.0.1/24 to any port 22

To add allow rules:
to allow an ip address

sudo ufw allow from <ip address>

to allow a port

sudo ufw <port number>

allow a specific ip address and port

sudo ufw allow from <ipaddress> to any port <port number>

advanced allow example for allowing access from an ip address range 10.120.0.1 - 10.120.0.255 to port 22

sudo ufw allow from 10.0.0.0/24 to any port 22

To get the current status of your UFW rules

sudo ufw status

To remove a deny or allow rule

sudo ufw delete <rule type> from <ip address> to any port <port number>

(note: you basically match the syntax for the creation of the rule and add 'delete')

You need to be careful with setting up allow and deny rules that 'intersect' because the first rule matched is applied and the remaining are ignored.

SECNARIO:
you want to block access to port 22 from 192.168.0.1 and 192.168.0.7 but allow all other 192.168.0.x IPs to have access to port 22

sudo ufw deny from 192.168.0.1 to any port 22
sudo ufw deny from 192.168.0.7 to any port 22
sudo ufw allow from 192.168.0.0/24 to any port 22

if you do the allow statement before either of the deny statements it will be matched first and the deny will not be evaluated.

you can check this by checking ufw status

sudo ufw status
To                         Action  From
--                         ------  ----
22:tcp                     DENY    192.168.0.1
22:udp                     DENY    192.168.0.1
22:tcp                     DENY    192.168.0.7
22:udp                     DENY    192.168.0.7
22:tcp                     ALLOW   192.168.0.0/24
22:udp                     ALLOW   192.168.0.0/24

the allow is at the bottom and will be the last command evaluated if it appeared above the deny rules the deny rules would not be evaluated.

I hope this helps you use ufw to secure your computer.

Link to the documentation wiki

[Bakon Jarser]

Every time I restart my computer I have to restart ufw. Is there a way to make it enabled at startup?

[kevdog]

Can you ICS with ufw as you can in iptables?

[ugm6hr]

Every time I restart my computer I have to restart ufw. Is there a way to make it enabled at startup?

I would like to understand this too. I can't find any documentation that clarifies the situation.

I presume iptables boots at startup. And ufw is a "frontend" for iptables.

So does ufw need to be running to enable the open ports that I have defined with ufw?

ufw does not boot at startup:

sudo ufw status
[sudo] password for xxxxx: 
Firewall not loaded

I thought this was where the bootup setting was (default):

cat /etc/ufw/ufw.conf
# /etc/ufw/ufw.conf
# 

# set to yes to start on boot
ENABLED=yes

Any help?

[glitch32]

I would also like to know, I'm a little confused with this.

[kevdog]

Im curious also -- I know for example iptables does not by default store settings between boots unless the settings are exported and then imported at boot, or a startup script is launched that re-enters the settings back into iptables. (iptables-save, iptables-restore). I thought Network Manager had the iptables-save, restore code calls built in, however if you are not using network manager, then that's another issue). In theory however, since ufw uses iptables, it would be possible manually to save and restore the settings using the save/restore commands by calling iptables directly rather than ufw.

[clio]

Every time I restart my computer I have to restart ufw. Is there a way to make it enabled at startup?

i had the same problem before,when i find this gui -->> gufw link http://gufw.tuxfamily.org/screenshots.html

works all time after reboot,and very easy to use

[glitch32]

Finally a link that works! I tried downloading that from ubuntu-unleashed, (and quite a few others), but I could never get the link to work. Google always said forbidden. Thank you for that!

[bullgr]

Every time I restart my computer I have to restart ufw. Is there a way to make it enabled at startup?

try this (from ubuntu wiki: https://wiki.ubuntu.com/UbuntuFirewall)

Toggle logging:
# ufw logging on|off

[nvteighen]

Ehm... My ufw doesn't reset itself after reboot.