Knowledgebase

The Uncomplicated Firewall (UFW) offers a user-friendly interface for managing iptables firewall rules. Renowned for its simplicity and efficiency, UFW is especially popular among users of Debian/Ubuntu and AlmaLinux distributions. This guide is designed to assist you in installing, configuring, and managing UFW to enhance your system's security effectively.

1. Installing UFW

UFW is typically included by default in most Linux distributions. However, if it's not already installed on your system, follow the instructions below based on your distribution:

• Debian/Ubuntu:
  • Update your package list:

    sudo apt update

  • Install UFW:

    sudo apt install ufw

• AlmaLinux:
  • Enable the EPEL repository:

    sudo dnf install epel-release

  • Update your package list:

    sudo dnf update

  • Install UFW:

    sudo dnf install ufw

After installation, activate UFW with:

sudo ufw enable

Note: Enabling UFW will activate the firewall with default settings, which typically deny incoming connections and allow outgoing connections.

2. Basic Usage of UFW

UFW simplifies firewall management with straightforward commands. Here are some fundamental operations:

• Enable UFW:

  sudo ufw enable

  Activates the firewall.

• Disable UFW:

  sudo ufw disable

  Deactivates the firewall.

• Check UFW Status:

  sudo ufw status verbose

  Displays the current status and rules of the firewall.

• Reset UFW:

  sudo ufw reset

  Resets UFW to its default settings, removing all existing rules.

3. Managing UFW Rules

Configuring specific rules allows you to control the traffic to and from your system effectively. Here’s how to manage these rules:

• Allowing Connections:

  sudo ufw allow [service|port]

  Examples:

  • Allow SSH:

    sudo ufw allow ssh

  • Allow HTTP on port 80:

    sudo ufw allow 80

• Denying Connections:

  sudo ufw deny [service|port]

  Example:

  sudo ufw deny 23

  Deny connections on port 23 (Telnet).

• Deleting Rules:
  1. List all rules with numbering:

     sudo ufw status numbered

  2. Delete a specific rule by its number:

     sudo ufw delete [number]

     For example, to delete rule number 2:

     sudo ufw delete 2

• Allowing Connections from Specific IP Addresses:

  To restrict access to trusted IPs, use the following commands:

  • Allow a single IP:

    sudo ufw allow from 192.168.1.5

  • Allow a specific port from an IP:

    sudo ufw allow from 192.168.1.5 to any port 22

    Allows SSH from the IP address 192.168.1.5 only.

4. Advanced UFW Management

For users seeking more granular control, UFW offers advanced configurations:

• Setting Default Policies:

  sudo ufw default deny incoming

  sudo ufw default allow outgoing

  Sets the default policy to deny all incoming traffic and allow all outgoing traffic. Adjust as needed:

  • allow to permit traffic.
  • deny to block traffic.
• Enabling Logging:

  sudo ufw logging on

  Activates logging to monitor firewall activity. Logs are typically stored in /var/log/ufw.log.

• Using Application Profiles:

  Manage firewall rules based on predefined application profiles:

  • List available application profiles:

    sudo ufw app list

  • Allow a specific application, such as Nginx:

    sudo ufw allow 'Nginx HTTP'

• Rate Limiting:

  Protect against brute-force attacks by limiting the number of connection attempts:

  sudo ufw limit ssh

  This sets a rate limit on SSH connections.

• IPv6 Support:

  Ensure IPv6 support is enabled in UFW by checking the configuration file:

  sudo nano /etc/default/ufw

  Set IPV6=yes to enable.

5. Best Practices for Using UFW

Implementing best practices ensures your firewall remains effective and secure:

• Allow Essential Services Only: Only permit the services and ports necessary for your system's operation.
• Restrict SSH Access: Limit SSH access to specific IPs or use key-based authentication to enhance security.
• Regularly Update UFW and Your System: Keep your firewall and operating system updated to protect against the latest threats.
• Backup UFW Rules: Export and save your UFW configuration to recover quickly in case of system issues:

  sudo cp /etc/ufw/user.rules ~/ufw-backup.rules

• Monitor Logs: Regularly review UFW logs to detect and respond to suspicious activities.
• Test Firewall Rules: After setting up or modifying rules, verify that they work as intended without disrupting legitimate traffic.

6. Troubleshooting UFW

If you encounter issues with UFW, consider the following troubleshooting steps:

• Check UFW Status:

  sudo ufw status verbose

  Verify which rules are active.

• Review Logs:

  sudo less /var/log/ufw.log

  Inspect log files for any error messages or blocked attempts.

• Reset UFW:

  sudo ufw reset

  Resets UFW to default settings. Use with caution as it removes all existing rules.

• Disable and Re-enable UFW:

  sudo ufw disable
  sudo ufw enable

  Sometimes toggling the firewall off and on can resolve configuration issues.

7. Uninstalling UFW

If you decide to remove UFW from your system, follow the appropriate steps for your distribution:

• Debian/Ubuntu:

  sudo apt remove ufw
  sudo apt purge ufw

  The first command removes UFW, and the second removes configuration files.

• AlmaLinux:

  sudo dnf remove ufw

Mastering UFW on Debian/Ubuntu and AlmaLinux provides a robust layer of security for your systems. By following this guide, you've learned how to install, configure, and manage UFW effectively. A well-configured firewall is essential in defending against unauthorized access, network threats, and potential data breaches. Continue to refine your firewall rules and stay informed about best security practices to maintain a secure computing environment.