Ubuntu 22.04 Set Up UFW Firewall in 5 Minutes

See all Ubuntu Linux related FAQ
A Ubuntu 22.04 LTS comes with UFW (uncomplicated firewall) that protects the desktop or server against unauthorized access. UFW is easy to use frontend app for a Linux packet filtering system called Netfilter. Traditionally Netfilter rules are set up or configured using the iptables command by developers and sysadmins. However, new Ubuntu Linux users and developers unfamiliar with firewall concepts find Netfilter syntax confusing. Hence, the ufw project provides easy to use frontend for Ubuntu 22.04 LTS Linux server and desktop. It is so super easy to set up. You can configure UFW in under 5 minutes and secure your host.

This page explains how to set up a firewall with UFW on Ubuntu 22.04 LTS server or desktop.
Tutorial details
Difficulty level Easy
Root privileges Yes
Requirements Linux terminal
Category Firewall
OS compatibility Debian Linux Mint Ubuntu
Est. reading time 5 minutes
Advertisement

Ubuntu 22.04 LTS Set Up UFW Firewall in 5 Minutes

The steps are as follows for setting up UFW:

Step 1 – Set Up default UFW policies

Let us view the current status:
$ sudo ufw status
The default policy firewall works excellent for servers and the desktop. It is always a good policy to close all ports on the server and open only the required TCP or UDP ports. Let us block all incoming connections and only allow outgoing connections from the Ubuntu 22.04 LTS cloud server:
$ sudo ufw default allow outgoing
$ sudo ufw default deny incoming

Make sure IPv6 support enabled too. Run the grep command:
$ grep IPV6 /etc/default/ufw
Otherwise, edit the /etc/default/ufw:
$ sudo nano /etc/default/ufw
Set it as follows:

IPV6=yes

Step 2 – Open SSH TCP port 22 using the ufw

The next rational step is to allow incoming SSH connections on the default TCP port 22 as follows:
$ sudo ufw allow ssh
Say you are running the OpenSSH server on TCP port 4242, then:
$ sudo ufw allow 4242/tcp
You can limit ssh port access as follows too:
$ sudo ufw limit ssh
See “How to limit SSH (TCP port 22) connections with ufw on Ubuntu Linux” for more information.

Step 3 – Turning on the firewall

That is all needed. Now turn on the firewall protection for your Ubuntu Linux 22.04 LTS machine. For example:
$ sudo ufw enable
You need to confirm the operation by typing the y and followed by the [Enter] key:

How To Set Up a Firewall with UFW on Ubuntu 22.04 LTS

Click to enlarge

To view the current firewall status, type the systemctl command:
$ sudo ufw status
Please note that once UFW is enabled, it runs across system reboots. You can verify that easily using the systemctl command:
$ sudo systemctl status ufw.service

 ufw.service - Uncomplicated firewall
     Loaded: loaded (/lib/systemd/system/ufw.service; enabled; vendor preset: enabled)
     Active: active (exited) since Fri 2022-08-26 01:02:24 UTC; 20min ago
       Docs: man:ufw(8)
    Process: 433 ExecStart=/lib/ufw/ufw-init start quiet (code=exited, status=0/SUCCESS)
   Main PID: 433 (code=exited, status=0/SUCCESS)
        CPU: 2ms

Aug 26 01:02:24 localhost systemd[1]: Starting Uncomplicated firewall...
Aug 26 01:02:24 localhost systemd[1]: Finished Uncomplicated firewall.

Step 4 – Opening (allow) TCP or UDP ports

Now that you set up a firewall policy and opened TCP port 22 for ssh purposes, it is time to open other service ports as per the needs of your application. For example, open TCP port 80 and 443 for Nginx or Apache web server as follows:
$ sudo ufw allow 80/tcp comment 'Allow Apache HTTP'
$ sudo ufw allow 443/tcp comment 'Allow Nginx HTTPS'

Here is how to open the WireGuard VPN UDP port 41194, type:
$ sudo ufw allow 41194/udp comment 'Allow WireGuard VPN'
The ufw comment keywords adds comments, which act as an instrumental in understanding firewall rules.

Opening TCP and UDP port ranges

$ sudo ufw allow 4000:4200/tcp
$ sudo ufw allow 6000:7000/udp

Allowing connection from a single IP or CIDR

In this example, you want to allow ALL connections from an IP address called 1.2.3.4, enter:
$ sudo ufw allow from 1.2.3.4
Let us allow connections from an IP address called 1.2.3.4 to our port 25, enter:
$ sudo ufw allow from 1.2.3.4 to any port 25 proto tcp
And you can set destination IP 222.222.222.222 for port 25 too:
sudo ufw allow from 1.2.3.4 to 222.222.222.222 port 25 proto tcp

How to allow connection on specific interface

Open TCP port 22 for wg0 interface only:
$ sudo ufw allow in on wg0 to any port 22
Say you want to allow connection for TCP port 3306 on lxdbr0 interface from 10.105.28.22, then add:
$ sudo ufw allow in on lxdbr0 from 10.105.28.22 to any port 3306 proto tcp

Step 5 – Blocking TCP or UDP ports and connections

Do you want to close ports and block certain IP addresses? The syntax is as follows to deny access. In other words, simply ignoring access to port 23:
$ sudo ufw deny 23/tcp comment 'Block telnet'
Here is how to deny all connections from an IP address called 1.2.3.4, enter:
$ sudo ufw deny from 1.2.3.4
How about clock IP/subnet (CIDR) called 103.13.42.42/28, enter:
$ sudo ufw deny from 103.13.42.42/28
Finally, deny access to 1.1.1.2 (say bad guys or hacker IP address) on port 22? Try:
$ sudo ufw deny from 1.1.1.2 to any port 22 proto tcp

Step 6 – Viewing firewall rules

You can see firewall status as numbered list of RULES:
$ sudo ufw status numbered

How to view ufw firewall rules on Ubuntu Linux 22.04 LTS

Click to enlarge

Step 7 – Deleting ufw firewall rules

Get list all of the current rules in a numbered list format:
$ sudo ufw status numbered
Outputs:

Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere                  
[ 2] 80/tcp                     ALLOW IN    Anywhere                   # Allow Apache HTTP
[ 3] 443/tcp                    ALLOW IN    Anywhere                   # Allow Nginx HTTPS
[ 4] 41194/udp                  ALLOW IN    Anywhere                   # Allow WireGuard VPN
[ 5] 23/tcp                     DENY IN     Anywhere                   # Block telnet
[ 6] Anywhere                   DENY IN     103.13.42.32/28           
[ 7] 22/tcp (v6)                ALLOW IN    Anywhere (v6)             
[ 8] 80/tcp (v6)                ALLOW IN    Anywhere (v6)              # Allow Apache HTTP
[ 9] 443/tcp (v6)               ALLOW IN    Anywhere (v6)              # Allow Nginx HTTPS
[10] 41194/udp (v6)             ALLOW IN    Anywhere (v6)              # Allow WireGuard VPN
[11] 23/tcp (v6)                DENY IN     Anywhere (v6)              # Block telnet

To remove firewall rule # 6 type the command:
$ sudo ufw delete 6
$ sudo ufw status numbered

See how to delete a UFW firewall rule on Ubuntu / Debian Linux tutorial for further information.

Step 8 – Stopping and removing UFW

If you no longer need ufw, here is how to disable it:
$ sudo ufw disable
$ sudo ufw reset

Step 9 – View the firewall logs

By default all UFW entries are logged into /var/log/ufw.log file. Use the grep/less/more and other commands to view the ufw logs. For examples:
$ sudo more /var/log/ufw.log
$ sudo tail -f /var/log/ufw.log

Let us print a list of all IP address trying to log in via SSH port but dropped by the UFW:
$ grep 'DPT=22' /var/log/ufw.log |\
egrep -o 'SRC=([0-9]{1,3}[\.]){3}[0-9]{1,3}' |\
awk -F'=' '{ print $2 }' | sort -u

Finally, here is how to display the list of rules:
$ sudo ufw show listening
$ sudo ufw show added

Summing up

Wasn’t that easy? Now you know how to protect your Ubuntu 22.04 LTS Linux server. Please read the ufw command docs online or using the man command (ufw help command) as follows:
$ man ufw
$ ufw help

🥺 Was this helpful? Please add a comment to show your appreciation or feedback.

nixCrat Tux Pixel Penguin
Hi! 🤠
I'm Vivek Gite, and I write about Linux, macOS, Unix, IT, programming, infosec, and open source. Subscribe to my RSS feed or email newsletter for updates.

8 comments… add one
  • Anonymous Sep 1, 2022 @ 2:06

    I configured ufw on my Ubuntu home server 👍 thank you for great instructions.

  • Anonymous Sep 5, 2022 @ 15:22

    Really nice, informative and clear guide! Thanx for your effort :)

  • Frédéric Nov 11, 2022 @ 19:24

    Interesting how-to.

    Some suggestion:
    – add a § dealing with routers that need to let network communication to pass thru interface (with control of ufw),

    -you make a typewriting error into Step 4, into comment you’ve mentioned 442 rather than 443 (see bellow).

    "Step 4 – Opening (allow) TCP or UDP ports
    Now that you set up a firewall policy and opened TCP port 22 for ssh purposes, it is time to open other service ports as per the needs of your application. For example, open TCP port 80 and 442 for Nginx or Apache web server as follows:
    sudo ufw allow 80/tcp comment 'Allow Apache HTTP'
    sudo ufw allow 443/tcp comment 'Allow Nginx HTTPS'
    
    

    Here is how to open the WireGuard VPN UDP port 41194, type:

    • 🛡️ Vivek Gite (Author and Admin) Vivek Gite Nov 12, 2022 @ 6:33

      Fixed it. Thanks for the feedback.

  • Hoschi Apr 18, 2023 @ 19:45

    You might want to check the Port 25 rule in step 4

  • Ritu Khan Aug 2, 2023 @ 7:43

    Thank you for providing the host firewall tutorial page. It is helping new Ubuntu Linux admins transitioning from the RHEL world.

  • Rusik Sep 22, 2023 @ 9:21

    Дуже вам вдячний за вашу працю. Бажаю усіхів та наснаги в подальшому розвитку…

Leave a Reply

Your email address will not be published. Required fields are marked *

Use HTML <pre>...</pre> for code samples. Your comment will appear only after approval by the site admin.