The default firewall configuration tool for Ubuntu is ufw. Developed to ease iptables firewall configuration, ufw provides a user friendly way to create an IPv4 or IPv6 host-based firewall. By default UFW is disabled. (Gufw is a GUI that is available as a frontend).
To Set Default Rule
Setting the default mode of ufw is recommended before turning it on. This will deny or allow all incoming connections.
Set Default Deny:
1 | sudo ufw default deny |
Set Default Allow:
1 | sudo ufw default allow |
Enable and Disable
You can enable and disabke ufw with these commands.
Unless you have set the default to deny when you initially enable ufw, it is in ALLOW mode and will allow everything incoming and outgoing until you create rulesets.
To turn UFW on:
1 | sudo ufw enable |
To disable ufw use:
1 | sudo ufw disable |
Allow and Deny
Allow
1 | sudo ufw allow <port>/<optional: protocol> |
Example: To allow incoming tcp and udp packet on port 53
1 | sudo ufw allow 53 |
Example: To allow incoming tcp packets on port 53
1 | sudo ufw allow 53/tcp |
Example: To allow incoming udp packets on port 53
1 | sudo ufw allow 53/udp |
Deny
1 | sudo ufw deny <port>/<optional: protocol> |
Example: To deny tcp and udp packets on port 53
1 | sudo ufw deny 53 |
Example: To deny incoming tcp packets on port 53
1 | sudo ufw deny 53/tcp |
Example: To deny incoming udp packets on port 53
1 | sudo ufw deny 53/udp |
Delete Existing Rule
To delete a rule, simply prefix the original rule with delete. For example, if the original rule was:
1 | ufw deny 80/tcp |
Use this to delete it:
1 | sudo ufw delete deny 80/tcp |
Delete by number
List the rules by number with:
1 2 3 4 5 6 7 8 9 | sudo ufw status numbered Status: active To Action From -- ------ ---- [ 1] Apache ALLOW IN Anywhere [ 2] 53/tcp ALLOW IN Anywhere [ 3] 53/udp ALLOW IN Anywhere |
Delete (rule nr 2) with:
1 | sudo ufw delete 2 |
Services
You can also allow or deny by service name since ufw reads from /etc/services To see get a list of services:
1 | less /etc/services |
Allow by Service Name
1 | sudo ufw allow <service name> |
Example: to allow ssh by name
1 | sudo ufw allow ssh |
Deny by Service Name
1 | sudo ufw deny <service name> |
Example: to deny ssh by name
1 | sudo ufw deny ssh |
Status
Checking the status of ufw will tell you if ufw is enabled or disabled. This will also list the current ufw rules that are applied to your iptables.
To check the status of ufw:
1 2 3 4 5 6 7 8 9 10 11 12 | sudo ufw status Firewall loaded To Action From -- ------ ---- 22:tcp DENY 192.168.0.1 22:udp DENY 192.168.0.1 22:tcp DENY 192.168.0.7 22:udp DENY 192.168.0.7 22:tcp ALLOW 192.168.0.0/24 22:udp ALLOW 192.168.0.0/24 |
If ufw was not enabled the output would be:
1 2 3 | sudo ufw status Status: inactive |
Logging
To enable logging use:
1 | sudo ufw logging on |
To disable logging use:
1 | sudo ufw logging off |
Advanced Syntax
You can also use a fuller syntax, specifying the source and destination addresses and ports.
Allow Access
This section shows how to allow specific access.
Allow by Specific IP:
1 | sudo ufw allow from <ip address> |
Example: To allow packets from 123.456.789.123:
1 | sudo ufw allow from 123.456.789.123 |
Allow by Subnet
You may use a net mask :
1 | sudo ufw allow from 192.168.1.0/24 |
Allow by specific port and IP address
1 | sudo ufw allow from <ip address> to <protocol> port <port number> |
Example: allow ip address 192.168.0.4 access to port 22 for all protocols
1 | sudo ufw allow from 192.168.0.4 to any port 22 |
Enable PING
Note: Security by obscurity may be of very little actual benefit with modern cracker scripts.
By default, ufw allows ping requests. You may find you wish to leave (icmp) ping requests enabled to diagnose networking problems.
You need to edit /etc/ufw/before.rules and remove edit the following lines:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | # ok icmp codes -A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT -A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT -A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT -A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT -A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT Change the "ACCEPT" to "DROP" or # ok icmp codes -A ufw-before-input -p icmp --icmp-type destination-unreachable -j DROP -A ufw-before-input -p icmp --icmp-type source-quench -j DROP -A ufw-before-input -p icmp --icmp-type time-exceeded -j DROP -A ufw-before-input -p icmp --icmp-type parameter-problem -j DROP -A ufw-before-input -p icmp --icmp-type echo-request -j DROP |
Deny Access
Deny by specific IP
1 | sudo ufw deny from <ip address> |
Example:To block packets from 123.456.789.123:
1 | sudo ufw deny from 123.456.789.123 |
Deny by specific port and IP address
1 | sudo ufw deny from <ip address> to <protocol> port <port number> |
Example: deny ip address 192.168.0.1 access to port 22 for all protocols
1 | sudo ufw deny from 192.168.0.1 to any port 22 |
Advanced Blocking Rules
Blocking IP addresses is not so straight forward if you have an existing set of rules as IPTABLES matches in order.
So, if you started with default deny and added in port 80 for a public server :
1 | sudo ufw allow 80 |
1 | sudo ufw deny 123.456.789.123 |
You need to edit /etc/ufw/before.rules and add a section “Block IP” after “Drop INVALID packets” :
1 2 3 4 5 6 7 8 9 10 | -A ufw-before-input -s 123.456.789.123 -j DROP #Assuming no loging is desired of course) # drop INVALID packets # uncomment to log INVALID packets #-A ufw-before-input -m conntrack --ctstate INVALID -j LOG --log-prefix "[UFW B$ -A ufw-before-input -m conntrack --ctstate INVALID -j DROP # Block IP -A ufw-before-input -s 123.456.789.123 -j DROP |