How to Install and Configure UFW Firewall on Ubuntu 22.04 or 20.04

This in-depth guide will walk you through installing and configuring the Uncomplicated Firewall (UFW) on Ubuntu 22.04 and 20.04. We will provide multiple configuration examples, detailed explanations of each command, and discuss additional features such as logging, application profiles, and remote connections. This guide is designed for novice to intermediate users looking to improve their understanding of UFW and enhance their system security.

What is UFW Firewall?

UFW, or Uncomplicated Firewall, is a user-friendly, front-end interface for managing iptables firewall rules on Linux systems. It simplifies the process of configuring and maintaining a firewall by providing an easy-to-use command-line interface.

Why is having Firewalls Important?

Firewalls are crucial in protecting your system from unauthorized access and potential threats. They are a barrier between your internal network and the outside world, controlling incoming and outgoing traffic based on predefined rules.

Check if UFW is Installed

Before starting the installation and configuration process, checking if UFW is already installed on your system is essential. You can do this by executing the following command:

ufw version

If you see the version information, UFW is already installed. If not, you’ll see an error message. In that case, follow the steps below to install UFW:

sudo apt update
sudo apt install ufw

After installation, you can verify that UFW is installed by running ufw version again.

Using IPv6 with UFW (Optional)

UFW supports IPv6 by default. If you want to enable IPv6 support, open the UFW configuration file with your preferred text editor:

sudo nano /etc/default/ufw

Find the line that reads IPV6=no and change it to IPV6=yes.

Example:

Save the changes and exit the editor.

Setting Up Default Policies

Setting up default policies is essential to control incoming and outgoing traffic. The default policies will be applied to any traffic that doesn’t match any of the specific rules you create later. To set up default policies, use the following commands:

sudo ufw default deny incoming
sudo ufw default allow outgoing

These commands will deny all incoming connections and allow all outgoing connections by default.

Allowing SSH Connections

To allow SSH connections, execute the following command:

sudo ufw allow ssh

This command will allow incoming SSH connections on the default port (22). If you’re using a custom port for SSH, you can specify it like this:

sudo ufw allow 2222/tcp

This will allow incoming connections on port 2222, assuming you have configured your SSH server to listen on this port.

Enabling UFW

After setting up the default policies and allowing SSH connections, you can enable the UFW firewall with the following command:

sudo ufw enable

You will be prompted to confirm your action, as enabling UFW may disrupt existing connections. Enter ‘y’ to proceed with the operation.

Allowing Other Connections

To allow other connections, such as HTTP, HTTPS, or FTP, use the ufw allow command followed by the service name or port number. For example:

sudo ufw allow http
sudo ufw allow https
sudo ufw allow 21/tcp

These commands allow incoming connections for HTTP (port 80), HTTPS (port 443), and FTP (port 21).

If you need to allow connections for a range of ports, you can specify the range like this:

sudo ufw allow 8000:9000/tcp

This command allows incoming connections on TCP ports 8000 through 9000.

Denying Connections

To deny specific connections, use the ufw deny command followed by the service name or port number. For example:

sudo ufw deny 25/tcp

This command will deny incoming connections on port 25 (SMTP).

Deleting Rules

To delete a rule, use the ufw delete command followed by the rule’s parameters. For example:

sudo ufw delete allow 21/tcp

This command deletes the rule that allows incoming connections on port 21 (FTP).

Checking UFW Status and Rules

To check the status of the UFW firewall and view the current rules, use the following command:

sudo ufw status verbose

This command will display the UFW status, default policies, and any specific rules you’ve created.

UFW Logging

UFW provides logging functionality to track its actions and monitor potential issues. In this section, we’ll discuss how to configure and view logs.

Configuring Log Settings

To enable logging for UFW, use the ufw logging command followed by the desired log level (e.g., low, medium, high, or full). For example:

sudo ufw logging medium

This command sets the log level to “medium,” which logs blocked packets and new connections.

Viewing Logs

UFW logs are stored in the /var/log/ufw.log file by default. To view the log file, you can use a command like less, tail, or cat. For example:

sudo less /var/log/ufw.log

This command displays the log file using the less command, which allows you to scroll through the contents.

Application Profiles

UFW supports application profiles, which are predefined rules for popular applications. These profiles simplify the process of allowing or denying connections for specific applications. You can view available application profiles with the following command:

sudo ufw app list

To view the details of a specific profile, use the ufw app info command followed by the profile name:

sudo ufw app info 'Apache Full'

To allow or deny connections for an application profile, use the ufw allow or ufw deny command followed by the profile name:

sudo ufw allow 'Apache Full'

Testing UFW Rules

Before applying new rules, you may want to test them to ensure they work as expected. To simulate a connection and test UFW rules, you can use the nc (netcat) tool. First, you’ll need to install netcat if it’s not already installed:

sudo apt install netcat

Next, on the server-side, run the following command, replacing <port> with the port number you want to test:

nc -l <port>

On the client-side, connect to the server using the following command, replacing <server_ip> with the server’s IP address and <port> with the port number:

nc <server_ip> <port>

If the connection is successful, you can send messages between the server and the client by typing in the terminal. If the connection fails, the respective UFW rule might be blocking the traffic. Make sure to adjust your UFW rules accordingly and test again.

Disabling or Resetting UFW (Optional)

If you need to disable UFW temporarily, use the following command:

sudo ufw disable

To reset UFW to its default settings and remove all rules, use the ufw reset command:

sudo ufw reset

Please note that this action will erase all your custom rules, and you must reconfigure UFW from scratch.

Installing GUFW

As mentioned earlier, GUFW is a graphical front-end for managing UFW rules. To install GUFW on Ubuntu, use the following commands:

sudo apt update
sudo apt install gufw

After installation, you can launch GUFW from your application menu. The graphical interface makes it easy to manage your firewall rules without using the command line.

Conclusion

This guide has covered the installation and configuration of the UFW firewall on Ubuntu 22.04 and 20.04. We’ve discussed various configuration examples, including setting up default policies, allowing and denying connections, and managing rules. With this knowledge, you should be able to effectively secure your system and control network traffic according to your needs.

Additional Resources and Relevant Links

• UFW Official Documentation: Comprehensive guide on using and configuring UFW in Ubuntu systems.
• UFW Wiki: Collaborative platform with various articles and resources related to UFW.