In this article, we will show you how to install and configure UFW on an Ubuntu 18.04 VPS. First, we will take a moment to introduce and explain what firewalls are, and then we’ll show you how to use UFW and how to make the appropriate UFW configuration.
A firewall is a software program that monitors the network traffic and prevents unauthorized access to or from a private network. In regards to the Linux kernel, a Netfilter subsystem is implemented, which is used to manipulate the network traffic. Almost all modern Linux firewall solutions use this system to filter network packets. Additionally ‘iptables’ – a firewall utility accessible from the command line – is also part of the Netfilter framework. To simplify the process of creating firewall rules, Canonical (the creators of Ubuntu) developed an iptables interface called Uncomplicated Firewall (UFW).
If you are using Ubuntu 18.04 and want to secure your network without having to deal with learning how to use iptables, then UFW may be the appropriate solution you are looking for.
Table of Contents
Prerequisites
To follow this tutorial, you will need a server with Ubuntu 18.04 and SSH access with the root user (or a user with sudo privileges). Let’s begin with the tutorial.
Step 1: Connect to Your Server
Before we begin, you’ll need to connect to your server via SSH as root or user with sudo privileges. To do this, use the following command:
ssh root@IP_Address -p Port_Number
of course, you will need to replace IP_Address and Port_Number with your actual server IP address and SSH port number.
Once logged in, make sure that your server is up-to-date by running the following commands:
sudo apt update sudo apt upgrade
Step 2: Install UFW
UFW should be already installed by default on Ubuntu 18.04 – but if for some reason is is not installed, you can install it with this command:
sudo apt install ufw
Once the installation is complete, you can check the UFW status with the command:
sudo ufw status verbose
UFW by default is initially disabled, and if you never activated before you will get the output:
Output Status: inactive
If you already have UFW activated on your server, the output will look quite different and will look similar to the following:
Output: Status: active Logging: on (low) Default: deny (incoming), allow (outgoing), disabled (routed) New profiles: skip To Action From -- ------ ---- 22/tcp ALLOW IN Anywhere 80/tcp ALLOW IN Anywhere 443/tcp ALLOW IN Anywhere 22/tcp (v6) ALLOW IN Anywhere (v6) 80/tcp (v6) ALLOW IN Anywhere (v6) 443/tcp (v6) ALLOW IN Anywhere (v6) ....
Step 3: UFW Default Policies
The first thing you need to know is the default policies. By default, UFW is configured to deny all incoming connections and allow all outgoing connections. In other words, all of the connections that will try to access your server will be refused and all of your applications and services that are locally found on your server will be able to reach the outside world and access other servers.
If you want to check or change the default policies, you can find them in the /etc/default/ufw configuration file.
To set these UFW rules to the default, you can run the following commands:
sudo ufw default deny incoming sudo ufw default allow outgoing
Keep in mind that servers usually need to respond to an incoming request from Internet users. So, in most cases, you cannot set your firewall to block all incoming connections. In the next step, we’ll learn how to allow specific connections.
Step 4: Allow SSH Connections
Before you enable UFW, you need to allow SSH access on your server by adding a rule that will allow incoming SSH connections. Otherwise, you will get locked and you will not be able to connect to your Ubuntu server.
You can use the following command to configure the UFW firewall to allow all incoming SSH connections:
sudo ufw allow ssh
Then you will receive the following output:
Rules updated Rules updated (v6)
Please note that this command is only if your server listens to the standardized SSH port: 22. If the SSH service uses a custom non-standard port, you will need to open that port. If the SSH service on your server uses a unique port, for example port 900, then you can use the following command:
sudo ufw allow 900
Note that you’ll need to know what port number your service currently uses.
Step 5: Enable UFW
Now your firewall is configured to allow SSH connections and you are sure that your current SSH connection will not be affected, you can continue with enabling the UFW firewall.
sudo ufw enable
After which you will receive the following output:
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y Firewall is active and enabled on system startup
You will get a warning that tells you that you need to have configured allowing SSH rules, otherwise the existing SSH connection will be closed. Since you already have, type [y] and continue with [Enter].
Step 6: Allow Connections on Specific Ports
The applications and services that you use may need to have their ports opened for incoming and outgoing connections, depending on the application’s purpose. The most common ports you’ll need to unblock are ports 80 & 443, which are used by the web server, and 25, 110, 143, 587 and 993, which are used by the mail server.
We’ll show you through a few examples of how to allow incoming connections for some common services.
To allow all HTTP (port 80) connections, run this command:
sudo ufw allow http
Also, if you want to specify the port, you can apply what is essentially the same rule but with a different syntax:
sudo ufw allow 80
To allow all HTTPS (port 443) connections, run the command:
sudo ufw allow https
Additionally, if you want to specify the HTTPS port, you can apply the rule with a different syntax:
sudo ufw allow 443
If you are using a mail server, some of the next rules could be useful.
To allow all incoming SMTP you can run the command:
sudo ufw allow 25
To allow all incoming IMAP connections, run the command:
sudo ufw allow 143
And to allow all incoming IMAPS requests, you can use the command:
sudo ufw allow 993
If you are using POP3 instead, this command below will allow all incoming connections:
sudo ufw allow 110
And for all incoming POP3S requests, use this next command:
sudo ufw allow 995
Finally, if you are running a specific program that requires web access, you will need to enable to port specific to that program as well. For example, if you run Tomcat on your server, you will need port 8080. You can allow all incoming connections to this port with the command:
sudo ufw allow <port number>
You can do this for all specific ports that you may need.
Step 7: Allow Port Ranges
UFW also can allow access to port ranges instead of allowing access to a single port. When you want to allow port ranges at the UFW port, you need to specify the range of the port and the protocol, either TCP or UDP.
For example, if you want to allow the ports from 8069 to 8080 for both TCP and UDP, you can use the following commands:
sudo ufw allow 8069:8080/tcp sudo ufw allow 8069:8080/udp
Step 8: Allow Specific IP Addresses
If you want to allow only one IP address (for example a trusted machine found on your local network) to be able to access all ports, you can use the command:
sudo ufw allow from 206.207.208.209
On top of this, you can also allow a specific IP address to a particular port! Let’s say you want to allow a specific IP address to use the MySQL port (MySQL uses port 3306), then you can simply use this command:
sudo ufw allow from 206.207.208.209 to any port 3306
Step 9: Deny Connections
As mentioned earlier in Step 3, the default policy for incoming connections is set to ‘deny’. However, sometimes you may need to deny specific connections based on the source IP address or specific port.
The deny rule is very useful if you have an attack on your server from a specific IP address and your ports 80 and 443 are open. In this case, you can block that IP address using the following example. Of course, don’t forget to change the IP address 24.25.26.27 with the actual IP address that you want to block:
sudo ufw deny from 24.25.26.27
This will block the IP address from accessing all of your open ports. However, if you want to block the IP address from being able to access a particular port, you can use the next example:
sudo ufw deny from 24.25.26.27 to any port 80 sudo ufw deny from 24.25.26.27 to any port 443
As you can notice, creating deny rules is similar to the rules for allowing.
Step 10: Delete UFW Rules
The importance of deleting UFW rules is as important as creating them. There are two different ways to remove a UFW rule. The first method is by using the rule number, and the second is by specifying the actual rule.
If you want to delete the UFW rule with numbers, you will need to know the rule’s number. To list the rule numbers, you can use the command:
sudo ufw status numbered
Output:
Status: active
To Action From
-- ------ ----
[ 1] 80 ALLOW IN Anywhere
[ 2] 443 ALLOW IN Anywhere
[ 3] 22 ALLOW IN Anywhere
[ 4] Anywhere ALLOW IN 206.207.208.209
[ 5] 7022 ALLOW IN Anywhere
[ 6] 8069 ALLOW IN Anywhere
...
To remove the rule that is labeled as rule number 4, which allows connections from IP address 206.207.208.209, you can use the command:
sudo ufw delete 4
If you want to use the second method, which is to remove a rule by specifying the actual rule. Let’s say you want to close the port 8069 for example – in that case you would use the following command:
sudo ufw delete allow 8069
Step 11: Disable or Reset UFW
If for any reason you need to stop all UFW rules on your server, you can disable it by using the command:
sudo ufw disable
This will stop all rules that were currently active on your server. However, if you need to reactivate the firewall rules, you can simply enable it again.
sudo ufw enable
If for some reason you want to delete all of the rules and start with a fresh UFW, then you can use the following command:
sudo ufw reset
Please note that default policies will not change to their original settings if they have already been modified.
In this article, we showed you how to install UFW and then use it to configure a firewall on Ubuntu 18.04. Now you can use the knowledge of this guide to start creating your own UFW firewall rules and protect your server.
Of course, if you are one of our Managed Ubuntu Hosting customers, you don’t have to configure your firewall with UFW on your server – simply ask our admins, sit back, and relax. Our admins will configure the firewall rules on your server for you immediately.
PS. If you liked this post on how to configure a firewall with UFW on Ubuntu 18.04, please share it with your friends on the social networks using the share buttons below, or simply leave a comment in the comments section. Thanks.