Skip to content

ufw🔗

Back

NOTE: Do not copy paste these commands except you understand each of them.

Installation🔗

apt -y install ufw
systemctl enable ufw

Setup🔗

ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 22195
ufw allow from <EDGE_NODE_IP> to any port 8000  # connect edge agents to portainer

ufw default reject incoming
ufw default allow outgoing
ufw default deny routed

ufw show added
ufw show listening

After reviewed. Activate your firewall

ufw --force enable
ufw status verbose

Chain Default Action🔗

ufw [--dry-run] default allow|deny|reject [incoming|outgoing|routed]

Safe Mode (Allow all chain)🔗

ufw default allow incoming
ufw default allow outgoing
ufw default allow routed

ufw default reject incoming
ufw default allow outgoing
ufw default deny routed # drop forward chain

Firewall Rules🔗

Rule Syntax🔗

ufw [rule]
  [delete] [insert NUM] [prepend]
  allow|deny|reject|limit
  [in|out [on INTERFACE]]
  [log|log-all]
  [proto PROTOCOL]
  [from ADDRESS [port PORT | app APPNAME ]]
  [to ADDRESS [port PORT | app APPNAME ]]
  [comment COMMENT]

Abbreviated allow syntax using Port/Protocol🔗

ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp

Abbreviated allow syntax using Service Name🔗

ufw allow ssh
ufw allow http
ufw allow https

Check service name from /etc/services and replace port/protocol with it.

cat /etc/services | head -35 | tail -10

Abbreviated allow syntax using UFW Application Profile🔗

ufw allow OpenSSH
ufw allow 'Nginx Full'

# check available app profiels
ufw app list

# app profile info
ufw app info <appname>

# app profiles directory : /etc/ufw/applications.d/

Full allow incoming connection syntax🔗

## using port/protocol
ufw allow in proto tcp to any port 22## using service name
ufw allow in to any port ssh## using application profile
ufw allow in to any app OpenSSH

Allow incoming connection from specific source🔗

  • Network Interface: add in on <interface> after ufw
  • Source IP/CIDR: add from <IP/CIDR> after ufw allow
## specific incoming interface
ufw allow in on eth0 proto tcp to any port 22
ufw allow in on eth0 to any port ssh## specific source ip
ufw allow from 192.168.1.0/24 proto tcp to any port 22
ufw allow from 172.16.1.10 proto tcp to any port 80
ufw allow from 172.16.1.10 proto tcp to any port 443## or both
ufw allow in on eth0 from 192.168.1.0/24 to any port 22

Show Report🔗

Report Syntax🔗

ufw show raw
ufw show builtins|before-rules|user-rules|after-rules|logging-rules
ufw show listening
ufw show added

Show listening ports along with firewall rules🔗

ufw show listening

NOTE: if some service doesn’t have any rules then default chain action is executed.

Show added rules🔗

ufw show added

Control your Firewall🔗

  • ufw enable — Activate ufw by adding all ufw iptables rules
  • ufw disable — Remove all ufw iptables rules
  • ufw reload — Reload config (e.g. /etc/default/ufw /etc/ufw/* )

Status — Check UFW Status🔗

Syntax: ufw status [verbose|numbered]