Firewall UFW: A Beginner's Guide

Firewall UFW: A Beginner’s Guide

If you’re new to Linux, you might have heard of UFW or Uncomplicated Firewall. As the name suggests, UFW is a simple and user-friendly tool that allows you to manage your Linux firewall. This guide will walk you through the essentials of Firewall UFW.

In this article, we’ll go over some Firewall UFW essentials and explanations to help you get started.

What is a Firewall?

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between your computer or network and the internet or other networks.

Why Use UFW?

UFW is a front-end to the iptables firewall that comes pre-installed on most Linux distributions. It simplifies the process of managing the firewall by providing a user-friendly command-line interface. Using Firewall UFW is often much easier than directly configuring iptables.

UFW Essentials

Installation

UFW is pre-installed on most Linux distributions. However, if it’s not installed on your system, you can install it using the following command:

$ sudo apt-get install ufw

Basic Syntax

The basic syntax of UFW is as follows:

$ sudo ufw [option] [allow/deny] [port/protocol]

Here’s a breakdown of the syntax:

sudo: Executes the command with superuser privileges (necessary for firewall management).
ufw: The command-line utility for managing UFW.
[option]: Specifies the action to perform (e.g., enable, disable, status).
[allow/deny]: Determines whether to allow or block traffic.
[port/protocol]: Specifies the port number or protocol (e.g., 80, tcp) to which the rule applies.

Checking the Status

To check the status of UFW, run the following command:

$ sudo ufw status

This will show you the current status of UFW and the rules that are currently in effect.

Enabling and Disabling UFW

To enable UFW, run the following command:

$ sudo ufw enable

To disable UFW, run the following command:

$ sudo ufw disable

Default Policies

When you enable UFW, the default policies are set to deny all incoming traffic and allow all outgoing traffic. You can change the default policies using the following commands:

$ sudo ufw default allow [incoming/outgoing]
$ sudo ufw default deny [incoming/outgoing]

Allowing and Denying Traffic

To allow traffic to a specific port, run the following command:

$ sudo ufw allow [port/protocol]

To deny traffic to a specific port, run the following command:

$ sudo ufw deny [port/protocol]

Block an IP Address

To block all network connections that originate from a specific IP address, run the following command, replacing the highlighted IP address with the IP address that you want to block:

$ sudo ufw deny from 192.168.10.224

OutputRule added

In this example, from 192.168.10.224 specifies a source IP address of “192.168.10.224”.

If you run sudo ufw status now, you’ll see the specified IP address listed as denied:

OutputStatus: active
To                         Action      From
--                         ------      ----
Anywhere                   DENY        192.168.10.224

All connections, coming in or going out, are blocked for the specified IP address.

You can also Block connections from a whole subnet by providing the corresponding subnet mask for a host, such as 192.168.10.0/24.

Allow an IP Address

To allow all network connections that originate from a specific IP address, run the following command, replacing the highlighted IP address with the IP address that you want to allow access:

$ sudo ufw allow from 192.168.10.224

OutputRule added

If you run sudo ufw status now, you’ll see output similar to this, showing the word ALLOW next to the IP address you just added.

OutputStatus: active
To                         Action      From
--                         ------      ----
...
Anywhere                   ALLOW       192.168.10.224

You can also allow connections from a whole subnet by providing the corresponding subnet mask for a host, such as 192.168.10.0/24.

Delete UFW Rule

To delete a rule that you previously set up within UFW, use ufw delete followed by the rule (allow or deny) and the target specification. The following example would delete a rule previously set to allow all connections from an IP address of 192.168.10.224:

$ sudo ufw delete allow from 192.168.10.224

OutputRule deleted

Another way to specify which rule you want to delete is by providing the rule ID. This information can be obtained with the following command:

$ sudo ufw status numbered

OutputStatus: active
     To                         Action      From
     --                         ------      ----
[1] Anywhere                   DENY IN     192.168.10.220
[2] Anywhere on eth0           ALLOW IN    192.168.10.222

From the output, you can see that there are two active rules. The first rule, with highlighted values, denies all connections coming from the IP address 192.168.10.220. The second rule allows connections on the eth0 interface coming in from the IP address 192.168.10.222.

Because by default UFW already blocks all external access unless explicitly allowed, the first rule is redundant, so you can remove it. To delete a rule by its ID, run:

$ sudo ufw delete 1

You will be prompted to confirm the operation and to make sure the ID you’re providing refers to the correct rule you want to delete.

OutputDeleting:
 deny from 192.168.10.220
Proceed with operation (y|n)? y
Rule deleted

If you list your rules again with sudo ufw status, you’ll see that the rule was removed.

List Available Application Profiles

Upon installation, applications that rely on network communications will typically set up a UFW profile that you can use to allow connection from external addresses. This is often the same as running ufw allow from, with the advantage of providing a shortcut that abstracts the specific port numbers a service uses and provides a user-friendly nomenclature to referenced services.

To list which profiles are currently available, run the following:

$ sudo ufw app list

If you installed a service such as a web server or other network-dependent software and a profile was not made available within UFW, first make sure the service is enabled. For remote servers, you’ll typically have OpenSSH readily available:

OutputAvailable applications:
  OpenSSH

Allow All Incoming HTTP/HTTPS (port `443` / `80`)

Web servers, such as Apache and Nginx, typically listen for HTTP requests on port 80.

HTTPS typically runs on port 443. If your default policy for incoming traffic is set to drop or deny, you’ll need to create a UFW rule to allow external access on port 443. You can use either the port number or the service name (https) as a parameter to this command.

To allow all incoming HTTPS and HTTP (port 443 / 80) connections, run:

$ sudo ufw allow https,http

OutputRule added
Rule added (v6)

An alternative syntax is to specify the port number of the HTTPS service:

$ sudo ufw allow 443,80

Alternative Solutions for Firewall Management

While UFW provides a simplified interface, other methods exist for managing Linux firewalls. Here are two alternative approaches:

1. Direct iptables Configuration:

Instead of relying on UFW as a front-end, you can directly manipulate iptables rules. This offers greater flexibility and control but requires a deeper understanding of networking concepts and iptables syntax.

Explanation: iptables is the underlying firewall mechanism in most Linux distributions. It uses a table-based structure to define rules for filtering network traffic. Each table contains chains, which are sequences of rules that are evaluated in order.
How it Works: You use the iptables command to add, delete, and modify rules within these tables and chains. Rules specify criteria (e.g., source IP address, destination port) and actions (e.g., ACCEPT, DROP, REJECT) to be taken when traffic matches the criteria.

Code Example:

To achieve the same result as sudo ufw allow 443,80 using iptables, you would use the following commands:

sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

-A INPUT: Appends the rule to the INPUT chain (incoming traffic).
-p tcp: Specifies the TCP protocol.
--dport 80: Matches traffic with a destination port of 80.
--dport 443: Matches traffic with a destination port of 443.
-j ACCEPT: Accepts the traffic.
-m conntrack --ctstate ESTABLISHED,RELATED: This part ensures that only established connections are allowed for the return traffic, enhancing security.

Important Considerations for iptables:

Persistence: iptables rules are not persistent by default. After a reboot, the rules will be lost. You need to use a tool like iptables-persistent (Debian/Ubuntu) or similar to save the rules to a file and automatically load them on system startup.
Complexity: iptables syntax can be complex and error-prone. A single mistake can leave your system vulnerable. Careful planning and testing are essential.

2. Using firewalld:

firewalld is another firewall management tool available on many Linux distributions, particularly those using systemd. It provides a more dynamic and zone-based approach to firewall configuration.

Explanation: firewalld uses the concept of "zones" to define different levels of trust for network connections. Each zone has its own set of rules and services that are allowed or blocked. When a network interface is assigned to a zone, the corresponding rules are applied.
How it Works: You can use the firewall-cmd command to manage zones, services, ports, and other firewall settings. firewalld is designed to be more dynamic than iptables, allowing you to change firewall rules without interrupting existing connections.

Code Example:

To allow HTTP and HTTPS traffic using firewalld, you can use the following commands:

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

--permanent: Makes the changes persistent across reboots.
--add-service=http: Adds the HTTP service to the current zone (usually the default zone). firewalld has predefined service definitions for common applications.
--add-service=https: Adds the HTTPS service to the current zone.
--reload: Reloads the firewall configuration to apply the changes.

Advantages of firewalld:

Dynamic Management: Easier to manage firewall rules without disrupting existing connections.
Zone-Based Security: Provides a flexible way to define different security policies for different network environments.
Service Definitions: Simplifies the process of allowing common services by using predefined service definitions.

Choosing the Right Tool:

The best firewall management tool depends on your specific needs and expertise. UFW is a good choice for beginners who want a simple and easy-to-use interface. firewalld offers more advanced features and dynamic management capabilities. Direct iptables configuration provides the greatest flexibility but requires a deeper understanding of networking and firewall concepts.

Conclusion

Firewall UFW is a powerful and easy-to-use tool that allows you to manage your Linux firewall. With the Firewall UFW essentials and explanations provided in this article, you should now have a good understanding of how to get started with Firewall UFW.

Remember to always be cautious when configuring your firewall, and only allow traffic that is necessary for your system to function properly. Consider exploring the alternatives like iptables or firewalld as your understanding of networking deepens.