Ubuntu Firewall: Basic Introduction
This is a basic introduction to Ubuntu firewall using the terminal commands. This tutorial requires you have administrative access to your Ubuntu system. If you installed Ubuntu the first account created by default has administrative access via sudo. You will need to type sudo for each command illustrated below. The system will ask for your login password the first time (it will remember that password for about 15 minutes). Follow the steps below to check and modify the firewall.
Open a terminal window (ctrl t). In the terminal window enter:
you@ursystem:~$ sudo ufw status
[sudo] password for you:
Status: inactive
ufw stands for uncomplicated[1] firewall. It is a very simple interface to get you started. All modern Linux firewalls are based on the packet filtering framework developed and maintained by the folks at netfilter.org.
In the above example the firewall is not running to enable the firewall enter the command:
you@ursystem:~$ sudo ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup
You have enabled your firewall try the status command again to see the results. It reports active. The firewall is active but you have not set any rules. To allow ssh connections to your system enter the command:
you@yoursystem:~$ sudo ufw allow ssh
Rule added
Rule added (v6) (note this is displayed if you are also using IP v6)
You have just added ssh however you have allowed connection to port 22 from any location on the internet (using both UDP and TCP). You have also allowed connection using IPv6. If you are only using IPv4 delete the rule for IPv6 and harden the remaining rule to only allow tcp. To verify the above rules created enter the status command again. Look at the “From” column.
you@yoursystem:~$ sudo ufw status
Status: active
To Action From
— —— —-
22 ALLOW Anywhere
22 (v6) ALLOW Anywhere (v6)
Notice the one command generated 2 rules. It is best to be very specific and allow only the ip addresses you expect to connect from and the protocol to use. In this case we want to only allow TCP and from one IP address, using IPv4. I will delete the above rules, using the reset option.
You can reset the firewall by using the reset options as follows:
sudo ufw –force reset
Notice the “–force” option, this issues the command without asking for permission. The firewall is back to defaults. Issue “sudo ufw status” to verify.
Let’s enable the firewall again only this time to one specific IP address and using the TCP protocol version 4. To do so gather the IP address you want to ssh from and enter that IP in the command:
sudo ufw allow from {your ip address in here} to any port 22 proto tcp
Enter the command for status “sudo ufw status”. What do you see? Even though you created a firewall rule the firewall is still disabled from the previous reset command. Enable the firewall “sudo ufw enable” and run the status command again. You should see the new rule you just created.
This rule allows only the IP address entered in the brackets to connect to your system, via ssh.
In order to modify the rules you need to list them with numbers so enter the command:
you@yoursystem:~$ sudo ufw status
Status: active
To Action From
— —— —-
22/tcp ALLOW 10.0.0.20
Let’s add another rule to allow connections to your systems web server.
you@yoursystem:~$ sudo ufw allow from 10.0.0.20 to any port 80 proto tcp
Rule added
you@yoursystem:~$ sudo ufw status
Status: active
To Action From
— —— —-
22/tcp ALLOW 10.0.0.20
80/tcp ALLOW 10.0.0.20
Now you have 2 rules. Let’s list the rules with the associated number. Listing rules with numbers is needed when deleting rules.
you@yoursystem:~$ sudo ufw status numbered
Status: active
To Action From
— —— —-
[ 1] 22/tcp ALLOW IN 10.0.0.20
[ 2] 80/tcp ALLOW IN 10.0.0.20
Notice the numbers 1 and 2 in brackets, on the left before the rule. That represents the number for that rule.
To delete the second rule enter the command:
you@yoursystem:~$ sudo ufw delete 2
Deleting:
allow from 10.0.0.20 to any port 80 proto tcp
Proceed with operation (y|n)? y
Rule deleted
UFW verified you wanted to delete rule 2 and it requested you answer yes with a y. If you do not want to be prompted use the “–force” options as illustrated earlier. Below is a list of other commands you can issue (copied from the man page).
ufw [–dry-run] enable|disable|reload
ufw [–dry-run] default allow|deny|reject [incoming|outgoing|routed]
ufw [–dry-run] logging on|off|LEVEL
ufw [–dry-run] reset
ufw [–dry-run] status [verbose|numbered]
ufw [–dry-run] show REPORT
ufw [–dry-run] [delete] [insert NUM] allow|deny|reject|limit [in|out] [log|log-all] [ PORT[/PROTOCOL]
| APPNAME ] [comment COMMENT]
ufw [–dry-run] [rule] [delete] [insert NUM] allow|deny|reject|limit [in|out [on INTERFACE]]
[log|log-all] [proto PROTOCOL] [from ADDRESS [port PORT | app APPNAME ]] [to ADDRESS [port PORT | app
APPNAME ]] [comment COMMENT]
ufw [–dry-run] route [delete] [insert NUM] allow|deny|reject|limit [in|out on INTERFACE] [log|log-all]
[proto PROTOCOL] [from ADDRESS [port PORT | app APPNAME]] [to ADDRESS [port PORT | app APPNAME]] [com‐
ment COMMENT]
ufw [–dry-run] delete NUM
ufw [–dry-run] app list|info|default|update
As you can see ufw provides a plethora of commands and options. Let’s take the commands apart.
Above you see [–dry-run] which is the option to test the command without enabling it. The firewall can be enabled, disabled or the rules reloaded. The default behavior of the firewall can be se with the default option. You can set the log level to (low, medium, high or full) or turn it on of off. Reset, resets the firewall as illustrated above. The status command has the option numbered (illustrated above) or verbose which gives you additional information as to the behavior. You can add comments to the rules and even specify application names. The applications are stored in /etc/ufw/applications.d.
The show REPORT option gives you details about what the firewall is doing for example try this command:
you@yoursystem:~$ sudo ufw show listening
tcp:
139 * (smbd)
22 * (sshd)
[ 1] allow from 10.0.0.20 to any port 22 proto tcp
445 * (smbd)
tcp6:
139 * (smbd)
22 * (sshd)
445 * (smbd)
udp:
137 10.0.0.255 (nmbd)
137 10.0.0.80 (nmbd)
137 * (nmbd)
138 10.0.0.255 (nmbd)
138 10.0.0.80 (nmbd)
138 * (nmbd)
37937 * (dnsmasq)
49595 * (avahi-daemon)
5353 * (avahi-daemon)
631 * (cups-browsed)
udp6:
46295 * (avahi-daemon)
5353 * (avahi-daemon)
Notice the firewall is listening on so many ports can you tell if this is a server or desktop os? It’s most likely a desktop OS since it is listening on the Windows ports.
In conclusion ufw has many options and supports a simple and full syntax. I recommend using the full syntax and be very specific to open the specific port, protocol and ip addresses that need access.
[1] https://help.ubuntu.com/lts/serverguide/firewall.html.en