Ubuntu default Firewall UFW (Uncomplicated Firewall) Command-Line
UFW - Uncomplicated Firewall
The default firewall configuration tool for Ubuntu is ufw. Developed to ease iptablesfirewall configuration, ufw provides a user friendly way to create an IPv4 or IPv6 host-based firewall. By default UFW is disabled.
Gufw is a GUI that is available as a frontend.
Basic Syntax and Examples
Default rules are fine for the average home user
When you turn UFW on, it uses a default set of rules (profile) that should be fine for the average home user. That's at least the goal of the Ubuntu developers. In short, all 'incoming' is being denied, with some exceptions to make things easier for home users.
Enable and Disable
Enable UFW
To turn UFW on with the default set of rules:
sudo ufw enablesudo ufw status verboseyouruser@yourcomputer:~$ sudo ufw status verbose
sudo] password for youruser:
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing)
New profiles: skip
youruser@yourcomputer:~$
Note that by default, deny is being applied to incoming. There are exceptions, which can be found in the output of this command:
sudo ufw show rawYou can also read the rules files in /etc/ufw (the files whose names end with .rules).Disable UFW
To disable ufw use:
Allow and Deny (specific rules) Allow
example: To allow incoming tcp and udp packet on port 53
example: To allow incoming tcp packets on port 53
example: To allow incoming udp packets on port 53
Deny
example: To deny tcp and udp packets on port 53
example: To deny incoming tcp packets on port 53
example: To deny incoming udp packets on port 53
Delete Existing Rule
To delete a rule, simply prefix the original rule with delete. For example, if the original rule was:
Use this to delete it:
Services
You can also allow or deny by service name since ufw reads from /etc/services To see get a list of services:
Allow by Service Name
example: to allow ssh by name
Deny by Service Name
example: to deny ssh by name
Status
Checking the status of ufw will tell you if ufw is enabled or disabled and also list the current ufw rules that are applied to your iptables.
To check the status of ufw:
if ufw was not enabled the output would be:
To disable ufw use:
sudo ufw disablesudo ufw allow /sudo ufw allow 53sudo ufw allow 53/tcpsudo ufw allow 53/udpsudo ufw deny /sudo ufw deny 53sudo ufw deny 53/tcpsudo ufw deny 53/udpTo delete a rule, simply prefix the original rule with delete. For example, if the original rule was:
ufw deny 80/tcpsudo ufw delete deny 80/tcpYou can also allow or deny by service name since ufw reads from /etc/services To see get a list of services:
less /etc/servicessudo ufw allow sudo ufw allow sshsudo ufw deny sudo ufw deny sshChecking the status of ufw will tell you if ufw is enabled or disabled and also list the current ufw rules that are applied to your iptables.
To check the status of ufw:
sudo ufw statusFirewall loaded
To Action From
-- ------ ----
22:tcp DENY 192.168.0.1
22:udp DENY 192.168.0.1
22:tcp DENY 192.168.0.7
22:udp DENY 192.168.0.7
22:tcp ALLOW 192.168.0.0/24
22:udp ALLOW 192.168.0.0/24sudo ufw statusStatus: inactive Logging
To enable logging use:
To disable logging use:
Advanced Syntax
You can also use a fuller syntax, specifying the source and destination addresses, ports and protocols.
sudo ufw allow from
example:To allow packets from 207.46.232.182:
Allow by Subnet
You may use a net mask :
sudo ufw allow from to port
example: allow IP address 192.168.0.4 access to port 22 for all protocols
Allow by specific port, IP address and protocol
sudo ufw allow from to port proto
example: allow IP address 192.168.0.4 access to port 22 using TCP
Enable PING
Note: Security by obscurity may be of very little actual benefit with modern cracker scripts. By default, UFW allows ping requests. You may find you wish to leave (icmp) ping requests enabled to diagnose networking problems.
In order to disable ping (icmp) requests, you need to edit /etc/ufw/before.rules and remove the following lines:
or change the "ACCEPT" to "DROP"
To enable logging use:
sudo ufw logging onsudo ufw logging offYou can also use a fuller syntax, specifying the source and destination addresses, ports and protocols.
Allow Access
This section shows how to allow specific access.
This section shows how to allow specific access.
Allow by Specific IP
sudo ufw allow from
example:To allow packets from 207.46.232.182:
sudo ufw allow from 207.46.232.182You may use a net mask :
sudo ufw allow from 192.168.1.0/24Allow by specific port and IP address
sudo ufw allow from to port
example: allow IP address 192.168.0.4 access to port 22 for all protocols
sudo ufw allow from 192.168.0.4 to any port 22sudo ufw allow from to port proto
example: allow IP address 192.168.0.4 access to port 22 using TCP
sudo ufw allow from 192.168.0.4 to any port 22 proto tcpNote: Security by obscurity may be of very little actual benefit with modern cracker scripts. By default, UFW allows ping requests. You may find you wish to leave (icmp) ping requests enabled to diagnose networking problems.
In order to disable ping (icmp) requests, you need to edit /etc/ufw/before.rules and remove the following lines:
# ok icmp codes
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPTor change the "ACCEPT" to "DROP"
# ok icmp codes
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j DROP
-A ufw-before-input -p icmp --icmp-type source-quench -j DROP
-A ufw-before-input -p icmp --icmp-type time-exceeded -j DROP
-A ufw-before-input -p icmp --icmp-type parameter-problem -j DROP
-A ufw-before-input -p icmp --icmp-type echo-request -j DROPDeny Access
Deny by specific IP
sudo ufw deny from
example:To block packets from 207.46.232.182:
Deny by specific port and IP address
sudo ufw deny from to port
example: deny ip address 192.168.0.1 access to port 22 for all protocols
Working with numbered rules
Listing rules with a reference number
You may use status numbered to show the order and id number of rules:
Editing numbered rules
Delete numbered rule
You may then delete rules using the number. This will delete the first rule and rules will shift up to fill in the list.
Insert numbered rule
sudo ufw insert 1 allow from
Advanced Example
Scenario: You want to block access to port 22 from 192.168.0.1 and 192.168.0.7 but allow all other 192.168.0.x IPs to have access to port 22 using tcp
This puts the specific rules first and the generic second. Once a rule is matched the others will not be evaluated (see manual below) so you must put the specific rules first. As rules change you may need to delete old rules to ensure that new rules are put in the proper order.
To check your rules orders you can check the status; for the scenario the output below is the desired output for the rules to work properly
Deny by specific IP
sudo ufw deny from
example:To block packets from 207.46.232.182:
sudo ufw deny from 207.46.232.182sudo ufw deny from to port
example: deny ip address 192.168.0.1 access to port 22 for all protocols
sudo ufw deny from 192.168.0.1 to any port 22Listing rules with a reference number
You may use status numbered to show the order and id number of rules:
sudo ufw status numberedDelete numbered rule
You may then delete rules using the number. This will delete the first rule and rules will shift up to fill in the list.
sudo ufw delete 1sudo ufw insert 1 allow from
Advanced Example
Scenario: You want to block access to port 22 from 192.168.0.1 and 192.168.0.7 but allow all other 192.168.0.x IPs to have access to port 22 using tcp
sudo ufw deny from 192.168.0.1 to any port 22sudo ufw deny from 192.168.0.7 to any port 22sudo ufw allow from 192.168.0.0/24 to any port 22 proto tcpTo check your rules orders you can check the status; for the scenario the output below is the desired output for the rules to work properly
sudo ufw statusFirewall loaded
To Action From
-- ------ ----
22:tcp DENY 192.168.0.1
22:udp DENY 192.168.0.1
22:tcp DENY 192.168.0.7
22:udp DENY 192.168.0.7
22:tcp ALLOW 192.168.0.0/24Scenario change: You want to block access to port 22 to 192.168.0.3 as well as 192.168.0.1 and 192.168.0.7.
Tutorial from ubuntu.com
sudo ufw delete allow from 192.168.0.0/24 to any port 22sudo ufw statusFirewall loaded
To Action From
-- ------ ----
22:tcp DENY 192.168.0.1
22:udp DENY 192.168.0.1
22:tcp DENY 192.168.0.7
22:udp DENY 192.168.0.7
sudo ufw deny 192.168.0.3 to any port 22
sudo ufw allow 192.168.0.0/24 to any port 22 proto tcp
sudo ufw status
Firewall loaded
To Action From
-- ------ ----
22:tcp DENY 192.168.0.1
22:udp DENY 192.168.0.1
22:tcp DENY 192.168.0.7
22:udp DENY 192.168.0.7
22:tcp DENY 192.168.0.3
22:udp DENY 192.168.0.3
22:tcp ALLOW 192.168.0.0/24Tutorial from ubuntu.com
