UFW is an acronym for an uncomplicated firewall. Securing a network with an uncomplicated firewall is super easy and highly recommended. This page explains how to set up and secure your Ubuntu 20.04 LTS server with ufw.
Tutorial requirements | |
---|---|
Operating system/app | Ubuntu Linux 20.04 LTS |
Root privileges required | Yes |
Difficulty | Easy (rss) |
Estimated completion time | 15m |
Step 1 – Set Up default UFW policies
To view status of ufw, type:
sudo ufw status
Sample outputs:
Status: inactive
The default policy firewall works out great for both the servers and desktop. It is always a good policy to closes all ports on the server and open only required ports one by one. Let us block all incoming connection and only allow outgoing connections from the Ubuntu 20.04 LTS box:
sudo ufw default allow outgoing
sudo ufw default deny incoming
Enabling IPv6 support
Make sure the directive IPV6=yes do exists in /etc/default/ufw file. For instance:
cat /etc/default/ufw
Step 2 – Open SSH TCP port 22 connections
The next logical step is to allow incoming SSH ports. We can easily open SSH TCP port 22 using UFW as follows:
sudo ufw allow ssh
If you are running ssh on TCP port 2222 or TCP port 2323, enter:
sudo ufw allow 2222/tcp
sudo ufw allow 2323/tcp
Some sysadmins have a static IP address (such as 202.54.2.5) at home or office location. In that case, only allow ssh access from the static IP address such as 202.54.2.5 to Ubuntu server IP address 172.24.13.45:
sudo ufw allow proto tcp from 202.54.2.5 to 172.24.13.45 port 22
Let us limit ssh port, run:
sudo ufw limit ssh
See “How to limit SSH (TCP port 22) connections with ufw on Ubuntu Linux” for more information.
Step 3 – Turn on firewall
Now we got basic configuration enabled. In other words, the firewall will drop all incoming traffic except for ssh TCP port 22. Let us true it on the UFW, enter:
sudo ufw enable
Remember, once UFW enabled, it runs across system reboots too. We can verify that easily as follows using the systemctl command:
sudo systemctl status ufw.service
Want to disable the UFW based firewall? Try
If you need to stop the firewall and disable on system startup, eenter:
sudo ufw disable
Sample outputs:
Firewall stopped and disabled on system startup
Step 4 – Open specific incoming connections/ports
Let us add more rules. Say you want to open ports and allow IP address with ufw. The syntax is as follows to open TCP port 80 and 443:
sudo ufw allow 80/tcp comment 'accept Apache'
sudo ufw allow 443/tcp comment 'accept HTTPS connections'
Open UDP/1194 (OpenVPN) server:
sudo ufw allow 1194/udp comment 'OpenVPN server'
Allow port ranges via ufw
We can allow port ranges too say, tcp and udp 3000 to 4000:
sudo ufw allow 3000:4000/tcp
sudo ufw allow 3000:4000/udp
In this example, you want to allow ALL connections from an IP address called 104.22.10.214, enter:
sudo ufw allow from 104.22.10.214
Let us allow connections from an IP address called 104.22.11.213 to our port 25, enter:
sudo ufw allow from 104.22.11.213 to any port 25 proto tcp
We can set dest IP 222.222.222.222 for port 25 too:
sudo ufw allow from 104.22.11.213 to 222.222.222.222 port 25 proto tcp
Allow connection on specific interface
Open port 22 for wg0 interface only:
sudo ufw allow in on wg0 to any port 22
Say you want to allow connection for TCP port 3306 on lxdbr0 interface from 10.105.28.22, then add:
ufw allow in on lxdbr0 from 10.105.28.22 to any port 3306 proto tcp
Let us add sub/net instead of single IP address:
ufw allow in on lxdbr0 from 10.105.28.0/24 to any port 3306 proto tcp
Step 5 – Block and deny incoming connections/ports
Do you want to close ports and block certain IP addresses? The syntax is as follows to deny access. In other words, simply ignoring access to port 25:
sudo ufw deny 25/tcp
Make sure we deny all connections from an IP address called 203.5.1.43, enter:
sudo ufw deny from 203.5.1.43
Deny all connections from an IP/subnet called 103.13.42.13/29, enter:
sudo ufw deny from 103.13.42.13/29
Want to deny access to 1.1.1.2 (say bad guys IP) on port 22? Try:
sudo ufw deny from 1.1.1.2 to any port 22 proto tcp
Step 6 – Verify status of UFW
Use the status command as follows:
sudo ufw status
Status: active To Action From -- ------ ---- 22/tcp ALLOW Anywhere 80/tcp ALLOW Anywhere # accept Apache 443/tcp ALLOW Anywhere # accept HTTPS connections 1194/udp ALLOW Anywhere # OpenVPN server 3000:4000/tcp ALLOW Anywhere 3000:4000/udp ALLOW Anywhere Anywhere ALLOW 104.22.10.214 25/tcp ALLOW 104.22.11.213 222.222.222.222 25/tcp ALLOW 104.22.11.213 Anywhere DENY 203.5.1.43 Anywhere DENY 103.13.42.8/29 22/tcp DENY 1.1.1.2 22/tcp (v6) ALLOW Anywhere (v6) 80/tcp (v6) ALLOW Anywhere (v6) # accept Apache 443/tcp (v6) ALLOW Anywhere (v6) # accept HTTPS connections 1194/udp (v6) ALLOW Anywhere (v6) # OpenVPN server 3000:4000/tcp (v6) ALLOW Anywhere (v6) 3000:4000/udp (v6) ALLOW Anywhere (v6)
Want verbose outputs? Try:
sudo ufw status verbose
Ubuntu 20.04 LTS UFW delete rules
So far we learned how to add, deny, and list the firewall rules. It is time to delete unwanted rules. The syntax is as follows to list all of the current rules in a numbered list format:
sudo ufw status numbered
Status: active To Action From -- ------ ---- [ 1] 22/tcp ALLOW IN Anywhere [ 2] 80/tcp ALLOW IN Anywhere # accept Apache [ 3] 443/tcp ALLOW IN Anywhere # accept HTTPS connections [ 4] 1194/udp ALLOW IN Anywhere # OpenVPN server [ 5] 3000:4000/tcp ALLOW IN Anywhere [ 6] 3000:4000/udp ALLOW IN Anywhere
To delete 6th rule type the command:
sudo ufw delete 6
sudo ufw status numbered
See how to delete a UFW firewall rule on Ubuntu / Debian Linux tutorial for further information.
Other command used to configure firewall with UFW
Let us learn a few more important commands.
Reset the ufw
sudo ufw reset
Reload the ufw
sudo ufw reload
View the firewall logs
By default all UFW entries are logged into /var/log/ufw.log file. Use the NA command/more command/tail command and other commands to view the ufw logs:
sudo more /var/log/ufw.log
sudo tail -f /var/log/ufw.log
Let us print a list of all IP address trying to log in via SSH port but dropped by the UFW:
grep 'DPT=22' /var/log/ufw.log |\ egrep -o 'SRC=([0-9]{1,3}[\.]){3}[0-9]{1,3}' |\ awk -F'=' '{ print $2 }' | sort -u
Show the list of rules
sudo ufw show listening
sudo ufw show added
Outputs:
Added user rules (see 'ufw status' for running firewall): ufw allow from 10.8.0.0/24 to 10.8.0.1 port 22 proto tcp ufw allow from 10.8.0.0/24 to 10.8.0.1 port 3128 proto tcp ufw allow from 1t9.xxx.yyy.zzz to 1y2.aaa.bbb.ccc port 22 proto tcp
Setting up IP Masquerading with ufw
First edit the /etc/ufw/sysctl.conf and make sure you have the following line:
net/ipv4/ip_forward=1
# IPv6
#net/ipv6/conf/default/forwarding=1
#net/ipv6/conf/all/forwarding=1
Next add top of the /etc/ufw/before.rules/file], before the *filter section for 10.0.0.0/8 and wg0 interface:
*nat :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 10.0.0.0/8 -o wg0 -j MASQUERADE COMMIT
Save and close the file. Finally, add the ufw route to allow the traffic:
sudo ufw route allow in on eth0 out on wg0 from 10.0.0.0/8
See “How to configure ufw to forward port 80/443 to internal server hosted on LAN” for more info.
Setting up egress filtering
Let us say you want to block RFC1918 addresses going out of eth0 interfaces on your VM connected to the Internet. Add the ufw route rules to reject the traffic:
$ sudo ufw route reject out on eth0 to 10.0.0.0/8 comment 'RFC1918 reject'
$ sudo ufw route reject out on eth0 to 172.16.0.0/12 comment 'RFC1918 reject'
$ sudo ufw route reject out on eth0 to 192.168.0.0/16 comment 'RFC1918 reject'
Conclusion
In this quick tutorial, you learned how to secure your Ubuntu Linux 20.04 LTS server or desktop with the help of UFW. For more info, please see the ufw help page here.
- Install UFW firewall on Ubuntu 16.04 LTS server
- Open ssh port 22 using ufw on Ubuntu/Debian Linux
- Configure ufw to forward port 80/443 to internal server hosted on LAN
- Block an IP address with ufw on Ubuntu Linux server
- Limit SSH (TCP port 22) connections with ufw on Ubuntu Linux
- Ubuntu Linux Firewall Open Port Command Using UFW
- Open DNS port 53 using ufw on Ubuntu/Debian Linux
- Set Up a Firewall with UFW on Ubuntu 18.04
- Delete a UFW firewall rule
- Configure Firewall with UFW on Ubuntu 20.04 LTS
🐧 5 comments so far... add one ↓
Category | List of Unix and Linux commands |
---|---|
File Management | cat |
Firewall | Alpine Awall • CentOS 8 • OpenSUSE • RHEL 8 • Ubuntu 16.04 • Ubuntu 18.04 • Ubuntu 20.04 |
Network Utilities | dig • host • ip • nmap |
OpenVPN | CentOS 7 • CentOS 8 • Debian 10 • Debian 8/9 • Ubuntu 18.04 • Ubuntu 20.04 |
Package Manager | apk • apt |
Processes Management | bg • chroot • cron • disown • fg • jobs • killall • kill • pidof • pstree • pwdx • time |
Searching | grep • whereis • which |
User Information | groups • id • lastcomm • last • lid/libuser-lid • logname • members • users • whoami • who • w |
WireGuard VPN | Alpine • CentOS 8 • Debian 10 • Firewall • Ubuntu 20.04 |
Hi,
How can I enable ufw for lxd ? Any idea?
ufw is designed to run on VM or bare metal server. I never tried but will see if it works.
Dear,
I have look at almost every tutorial and proposed solution to have UFW running at system boot I could find. None has worked so far. Stating manually or with GUFW results in the status ‘active’. Alas after the next boot it is back to ‘inactive’. Do you have any idea where I might find a solution?
running : Ubuntu 20.04.1 fully updated
Run the following commands. Is ufw enabled at boot time?
sudo systemctl is-enabled ufw.service
If not enable it:
sudo systemctl enabled ufw.service
sudo ufw enable
Start the ufw:
sudo systemctl start ufw.service
Are you using any other firewall script or iptables based solution?
Yes, I use iptables directly. Can you specify those commands instead of ufw?