🛡️ UFW (Ubuntu Firewall)

What is UFW?

UFW (Uncomplicated Firewall) — the no-fuss firewall. As the name suggests, it simplifies complex iptables commands into plain English. If iptables is calculus, UFW is addition and subtraction.

Basic Operations

# Install (Ubuntu usually includes it)
sudo apt install ufw

# Enable firewall
sudo ufw enable
Firewall is active and enabled on system startup

# Disable firewall
sudo ufw disable

# View status
sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere

# Detailed status (shows rule numbers)
sudo ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 2] 80/tcp                     ALLOW IN    Anywhere
[ 3] 443/tcp                    ALLOW IN    Anywhere
[ 4] 22/tcp (v6)                ALLOW IN    Anywhere (v6)

Allow and Deny Rules

# Allow SSH
sudo ufw allow ssh
sudo ufw allow 22/tcp        # Same effect

# Allow HTTP and HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Allow port range
sudo ufw allow 3000:4000/tcp

# Allow only a specific IP to access SSH
sudo ufw allow from 192.168.1.100 to any port 22

# Allow a specific IP to access all ports
sudo ufw allow from 192.168.1.0/24

# Allow a specific subnet to access a specific port
sudo ufw allow from 10.0.0.0/8 to any port 3306

# Deny a specific IP
sudo ufw deny from 10.0.0.50

# Delete rule (by rule content)
sudo ufw delete allow 80/tcp

# Delete rule (by number, check numbers first)
sudo ufw status numbered
sudo ufw delete 2

Application Profiles

# View available application profiles
sudo ufw app list
Available applications:
  Nginx Full
  Nginx HTTP
  Nginx HTTPS
  OpenSSH

# Allow by application name
sudo ufw allow "Nginx Full"      # HTTP + HTTPS
sudo ufw allow "Nginx HTTP"      # HTTP only
sudo ufw allow "OpenSSH"         # SSH

# View application details
sudo ufw app info "Nginx Full"
Profile: Nginx Full
Title: Web Server (Nginx, HTTP + HTTPS)
Description: Small, but very powerful and efficient web server

Ports:
  80,443/tcp

Logging and Reset

# Enable logging
sudo ufw logging on

# Set log level (low/medium/high/full)
sudo ufw logging medium

# View logs
sudo tail -f /var/log/ufw.log

# Reset all rules (restore defaults)
sudo ufw reset
Resetting all rules to installed defaults. This may continue
to populate the current ruleset with the rules from the
package. Proceed with operation (y/N)?