The default firewall configuration tool for Ubuntu is ufw. Developed to ease iptables firewall configuration, ufw provides a user friendly way to create an IPv4 or IPv6 host-based firewall.
ufw by default is initially disabled. From the ufw man page:
“ ufw is not intended to provide complete firewall functionality via its command interface, but instead provides an easy way to add or remove simple rules. It is currently mainly used for host-based firewalls. ”
The following are some examples of how to use ufw:
First, ufw needs to be enabled. From a terminal prompt enter:
sudo ufw enable
To open a port (ssh in this example):
sudo ufw allow 22
Rules can also be added using a numbered format:
sudo ufw insert 1 allow 80
Similarly, to close an opened port:
sudo ufw deny 22
To remove a rule, use delete followed by the rule:
sudo ufw delete deny 22
It is also possible to allow access from specific hosts or networks to a port. The following example allows ssh access from host 192.168.0.2 to any ip address on this host:
sudo ufw allow proto tcp from 192.168.0.2 to any port 22
Replace 192.168.0.2 with 192.168.0.0/24 to allow ssh access from the entire subnet.
Adding the --dry-run option to a ufw command will output the resulting rules, but not apply them. For example, the following is what would be applied if opening the HTTP port:
sudo ufw --dry-run allow http
*filter :ufw-user-input - [0:0] :ufw-user-output - [0:0] :ufw-user-forward - [0:0] :ufw-user-limit - [0:0] :ufw-user-limit-accept - [0:0] ### RULES ### ### tuple ### allow tcp 80 0.0.0.0/0 any 0.0.0.0/0 -A ufw-user-input -p tcp --dport 80 -j ACCEPT ### END RULES ### -A ufw-user-input -j RETURN -A ufw-user-output -j RETURN -A ufw-user-forward -j RETURN -A ufw-user-limit -m limit --limit 3/minute -j LOG --log-prefix "[UFW LIMIT]: " -A ufw-user-limit -j REJECT -A ufw-user-limit-accept -j ACCEPT COMMIT Rules updated
ufw can be disabled by:
sudo ufw disable
To see the firewall status, enter:
sudo ufw status
And for more verbose status information use:
sudo ufw status verbose
To view the numbered format:
sudo ufw status numbered
If the port you want to open or close is defined in
This is a quick introduction to using ufw. Please refer to the ufw man page for more information.
ufw Application Integration
Applications that open ports can include an ufw profile, which details the ports needed for the application to function properly. The profiles are kept in
/etc/ufw/applications.d, and can be edited if the default ports have been changed.
To view which applications have installed a profile, enter the following in a terminal:
sudo ufw app list
Similar to allowing traffic to a port, using an application profile is accomplished by entering:
sudo ufw allow Samba
An extended syntax is available as well:
ufw allow from 192.168.0.0/24 to any app Samba
Replace Samba and 192.168.0.0/24 with the application profile you are using and the IP range for your network.
There is no need to specify the protocol for the application, because that information is detailed in the profile. Also, note that the app name replaces the port number.
To view details about which ports, protocols, etc are defined for an application, enter:
sudo ufw app info Samba
Not all applications that require opening a network port come with ufw profiles, but if you have profiled an application and want the file to be included with the package, please file a bug against the package in Launchpad.