Firewalls using UFW

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on a defined set of security rules. This page introduces Uncomplicated Firewall (UFW), a firewall tool that simplifies firewall configuration on Linux systems using iptables.

There are also some graphical user interface (GUI) frontends available for UFW, such as GUFW, but ufw commands are typically run on the command line. This page provides an overview of, and basic instructions for, the UFW command-line interface.

Uncomplicated Firewall (UFW)

Edit this on GitHub

Network traffic is organised by port numbers, which are numerical labels used to direct data to specific applications. Firewalls control traffic by opening and closing particular ports to allow or block certain types of communication.

On Linux systems, network traffic is filtered through the kernel’s firewall subsystem, called netfilter. Netfilter implements packet filtering; it blocks or allows data packets to pass through your system based on things like their source IP address, destination IP address, port number, protocol, and direction.

System administrators configure netfilter using iptables, which is the traditional command-line tool for defining packet-filtering rules. However, iptables can be complex. UFW (Uncomplicated Firewall), the firewall tool used by Ubuntu, simplifies firewall configuration and management. It acts as a wrapper for iptables, allowing system administrators to set firewall rules without dealing with the complexity of raw iptables commands.

UFW commands

UFW is a command-line program used to define firewall access rules. The typical syntax for ufw commands is: sudo ufw [--dry-run] <command> [rule].

All ufw commands require superuser privileges, and so must be preceded with sudo.
Optionally, you can add --dry-run to simulate the ufw command without making actual changes.
The <command> is the main action that you want to perform, such as allow.
Depending on the command, you can optionally specify a rule to apply to the command, such as allow 22.

For example, sudo ufw --dry-run allow 22 shows you the would-be outcome of allowing traffic on port 22, including the entire set of rules if the change were made.

Install and enable UFW

To use UFW, you must first install it on your Raspberry Pi. After installation, UFW is present but disabled, meaning that it doesn’t block any traffic yet. This allows you to configure default access rules without locking yourself out. This is especially important if you’re connected to your Raspberry Pi device over SSH (or any other remote method); to avoid being locked out, you must allow remote access before enabling UFW.

If you’re connected over SSH, the recommended flow of actions is as follows:

Step Description Command

Step	Description	Command
1	Update your package list.	`sudo apt-get update`
2	Install UFW. Before UFW is enabled, the output says that UFW is inactive.	`sudo apt install ufw`
3	Verify the installation by checking the status. For information about this command, see Rule management.	`sudo ufw status`
4	Optionally (but recommended), configure default policies, such as denying all incoming traffic. Defaults apply globally.	`sudo ufw default deny incoming`
5	To maintain remote access, allow SSH (before enabling UFW), either by specifying the service name (ssh) or the default port (22/tcp).	`sudo ufw allow ssh` OR `sudo ufw allow 22/tcp`
6	Optionally, if you’re running a web server, allow HTTP and HTTPS traffic, either by specifying the service names (http and https) or their default ports (80/tcp and 443/tcp, respectively).	`sudo ufw allow http` `sudo ufw allow https` OR `sudo ufw allow 80/tcp` `sudo ufw allow 443/tcp`
7	Enable UFW to activate the firewall and configure it to start up on boot.	`sudo ufw enable`
8	Verify the status of the firewall and review the active rules. For information about this command, see Rule management.	`sudo ufw status verbose`

Update your package list.

sudo apt-get update

Install UFW. Before UFW is enabled, the output says that UFW is inactive.

sudo apt install ufw

Verify the installation by checking the status. For information about this command, see Rule management.

sudo ufw status

Optionally (but recommended), configure default policies, such as denying all incoming traffic. Defaults apply globally.

sudo ufw default deny incoming

To maintain remote access, allow SSH (before enabling UFW), either by specifying the service name (ssh) or the default port (22/tcp).

sudo ufw allow ssh
OR
sudo ufw allow 22/tcp

Optionally, if you’re running a web server, allow HTTP and HTTPS traffic, either by specifying the service names (http and https) or their default ports (80/tcp and 443/tcp, respectively).

sudo ufw allow http
sudo ufw allow https
OR
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Enable UFW to activate the firewall and configure it to start up on boot.

sudo ufw enable

Verify the status of the firewall and review the active rules. For information about this command, see Rule management.

sudo ufw status verbose

You can disable UFW at any time, which stops it from starting up on boot. Use the following command to disable the UFW firewall:

$ sudo ufw disable

Use allow and deny rules

This section lists the basic commands for allowing and denying traffic through specified service names and ports. The general ufw syntax for allow and deny commands are as follows:

Allow access to a particular port or service: sudo ufw allow [rule]
Deny access to a particular port or service: sudo ufw deny [rule]

The following table provides specific examples.

Command Description

Command	Description
`sudo ufw allow 22`	Allows access to port 22 through the firewall. This opens the port for all protocols (TCP and UDP).
`sudo ufw allow 22/tcp`	Allows TCP only on port 22.
`sudo ufw allow ssh`	Allows the SSH service without specifying the port (SSH is usually port `22/tcp`).
`sudo ufw deny 22`	Denies access to port 22 through the firewall. This closes the port for all protocols (TCP and UDP).
`sudo ufw deny 22/tcp`	Denies TCP only on port 22.
`sudo ufw deny ssh`	Denies the SSH service without specifying the port (SSH is usually port `22/tcp`).

sudo ufw allow 22

Allows access to port 22 through the firewall. This opens the port for all protocols (TCP and UDP).

sudo ufw allow 22/tcp

Allows TCP only on port 22.

sudo ufw allow ssh

Allows the SSH service without specifying the port (SSH is usually port 22/tcp).

sudo ufw deny 22

Denies access to port 22 through the firewall. This closes the port for all protocols (TCP and UDP).

sudo ufw deny 22/tcp

Denies TCP only on port 22.

sudo ufw deny ssh

Denies the SSH service without specifying the port (SSH is usually port 22/tcp).

Advanced UFW rules

UFW can do more than basic allow and deny rules. It can also:

Allow or block a specific IP address from a specific port.
Specify traffic direction (incoming and outgoing).
Rate limit connection attempts to help protect against brute-force or DDoS attacks.
Specify network interfaces to apply rules specifically to wired or wireless networks.

For more information about these options, run the following command: man ufw. This displays the UFW manual page in your terminal, which includes documentation on UFW syntax, options, rule formatting, and examples.

Allow or block a specific IP address

You can allow or deny access from a specific IP address to a specific port. This is useful if you want to block suspicious hosts or allow trusted hosts only. For example, the following command denies access to port 30 from IP address 192.168.2.1

$ sudo ufw deny from 192.168.2.1 to any port 30

Specify traffic direction

To control how your system sends or receives network traffic, perhaps to block threats to your system (incoming) or protect system resources (outgoing), you can prevent traffic from coming in one or both directions. Specifically, you can add out (for outgoing traffic) or in (for incoming traffic) to one of the following commands:

allow, which allows the traffic to flow in the specified direction.
deny, which silently drops the traffic flowing in the specified direction.
reject, which actively refuses the traffic flowing in the specified direction.

For example, the following command prevents all outgoing traffic on the SMTP port (usually port 25/TCP):

$ sudo ufw reject out smtp

Rate limit connection attempts

To protect against brute-force and DDoS attacks, the limit command temporarily blocks any IP address that attempts to make too many connections in a short period of time (approximately 6 or more times within 30 seconds). For example, the following command watches how often an IP address attempts to open a new connection to SSH (usually port 22/tcp) and applies the rate limit.

$ sudo ufw limit ssh/tcp

Specify network interfaces

You can set firewall rules to apply only to a specific network connection (eth0 for wired networks or wlan0 for Wi-Fi). For example, the following command allows incoming TCP traffic on port 80 only on the eth0 network interface:

$ sudo ufw allow in on eth0 to any port 80 proto tcp

Rule management

UFW processes rules in order, so earlier rules take precedence over later ones. The following table lists useful commands to help you inspect your current firewall configuration and remove rules when necessary.

Command Description

Command	Description
`sudo ufw status`	Displays whether UFW is active and lists all current settings for the firewall (which ports and services are allowed and denied).
`sudo ufw status verbose`	Displays additional details, such as default policies and logging settings.
`sudo ufw show added`	Displays only user-added rules (excluding internal and system rules). This is useful if you want to review changes or compare configurations across systems.
`sudo ufw status numbered`	Displays rules with their assigned index number. This is useful if you want to delete a specific rule.
`sudo ufw delete <number>`	Deletes the rule that you specify based on its assigned index number. UFW then renumbers the remaining entries. You can rerun `sudo ufw status numbered` to confirm the rule was removed.

sudo ufw status

Displays whether UFW is active and lists all current settings for the firewall (which ports and services are allowed and denied).

sudo ufw status verbose

Displays additional details, such as default policies and logging settings.

sudo ufw show added

Displays only user-added rules (excluding internal and system rules). This is useful if you want to review changes or compare configurations across systems.

sudo ufw status numbered

Displays rules with their assigned index number. This is useful if you want to delete a specific rule.

sudo ufw delete <number>

Deletes the rule that you specify based on its assigned index number. UFW then renumbers the remaining entries. You can rerun sudo ufw status numbered to confirm the rule was removed.

Documentation