UFW (Uncomplicated FireWall)¹ is a command-line frontend for managing Linux firewall rules. UFW uses the Linux kernel's Netfilter framework to enforce these rules, traditionally through the iptables interface and, on modern Ubuntu systems, often through iptables-nft, which translates rules to the nftables backend. Netfilter performs the actual packet filtering in the kernel, while UFW provides a simpler interface for configuring and managing the firewall.

A short manual to UFW on Ubuntu

UFW (Uncomplicated Firewall) is Ubuntu's command-line tool for managing the system firewall. It provides a simple way to control incoming and outgoing network traffic without having to configure low-level firewall rules manually.

This guide covers the commands you'll need for everyday administration.

1. Check the firewall status

Check whether UFW is enabled and see the current rules:

sudo ufw status

For more details, including rule numbers and logging status:

sudo ufw status verbose
sudo ufw status numbered

2. Enable and disable UFW

Before enabling the firewall on a remote server, make sure you have allowed SSH access (see section 4). Otherwise, you could lock yourself out.

sudo ufw enable
sudo ufw disable

To reload the firewall after changing its configuration:

sudo ufw reload

3. Set default policies

A common configuration for a server is to block incoming connections while allowing outgoing connections.

sudo ufw default deny incoming
sudo ufw default allow outgoing

These policies mean:

• Incoming: New inbound connections are blocked unless explicitly allowed.
• Outgoing: Applications can initiate outbound connections.
• Established connections: Replies to permitted connections are generally allowed automatically.

For a desktop computer, these defaults are also a reasonable starting point.

4. Allow incoming connections

Allow a service by port number:

sudo ufw allow 22/tcp     # SSH
sudo ufw allow 80/tcp     # HTTP
sudo ufw allow 443/tcp    # HTTPS

Allow a port for both TCP and UDP:

sudo ufw allow 53

Allow an application by its predefined profile:

sudo ufw app list
sudo ufw app info 'OpenSSH'
sudo ufw allow OpenSSH

Application profiles are defined in /etc/ufw/applications.d/.

5. Restrict access to specific IP addresses

Allow SSH only from a specific IP address:

sudo ufw allow from 192.168.1.100 to any port 22 proto tcp

Allow an entire subnet to access a service:

sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp

Restrict access to a particular network interface, for example:

sudo ufw allow in on eth0 to any port 80 proto tcp

Replace eth0 with the actual interface name, which you can find with ip link.

6. Deny connections

Explicitly deny access to a port:

sudo ufw deny 23/tcp

Reject connections from a specific IP address:

sudo ufw deny from 203.0.113.50

Limit repeated connection attempts, for example SSH:

sudo ufw limit 22/tcp

The limit rule rate-limits connections to help reduce brute-force attempts; it is not a substitute for proper SSH security.

7. Delete a rule

There are two ways to remove a rule.

By specifying the original rule:

sudo ufw delete allow 80/tcp

By rule number:

sudo ufw status numbered
sudo ufw delete 3

Always check the numbered list before deleting. Rule numbers can change after a deletion.

8. Enable logging

Enable firewall logging:

sudo ufw logging on

Set the logging verbosity:

sudo ufw logging low
sudo ufw logging medium
sudo ufw logging high

View firewall-related kernel messages on Ubuntu:

sudo journalctl -k -f

Depending on the system configuration, UFW messages may also be available in /var/log/ufw.log or /var/log/kern.log.

Disable logging if necessary:

sudo ufw logging off

9. Reset the firewall

To remove UFW rules and return to its initial configuration:

sudo ufw reset

This disables UFW and resets its rules. You will need to configure it again before re-enabling it. Use this command with care, especially on remote servers.

10. Example: basic web server

Here is a minimal configuration for an Ubuntu server running a website over HTTPS and accepting SSH administration:

# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow administration
sudo ufw allow 22/tcp

# Allow web traffic
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable the firewall
sudo ufw enable

# Verify the configuration
sudo ufw status verbose

If SSH uses a different port, adjust the SSH rule accordingly. If your server is managed remotely, verify that SSH access works before closing your existing session.

Quick reference