> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# UFW Firewall Basics
> This article introduces UFW, a user-friendly firewall interface for managing Linux firewall rules on an Ubuntu server.
In this lesson, we introduce UFW (Uncomplicated Firewall), a user-friendly interface designed to simplify managing Linux firewall rules. We'll walk through configuring UFW on an Ubuntu server (app01) to restrict network access and secure your environment.
Imagine a setup where access to app01 must be limited. In this scenario, only the jump server with IP address 172.16.238.5 is allowed to establish SSH connections. This jump server is the primary access point for system administrators. Additionally, app01 hosts a web server on port 80, which needs to be accessible not only from the jump server but also from internal clients within the IP range 172.16.100.0/28.
All other ports on app01 must remain closed to inbound traffic. To achieve this, we leverage Netfilter, the Linux kernel's internal packet filtering system. Although IPTables is a common command-line tool for managing firewall rules, its complexity often demands a simpler solution. UFW serves as an intuitive front-end for configuring IPTables.
## Inspecting Active Ports
Before configuring UFW, log in via SSH to app01 and inspect the active listening ports using the netstat utility. Run the following command to confirm that SSH (port 22) and HTTP (port 80) are active, along with port 8080 which should be blocked from inbound connections:
```bash theme={null}
netstat -an | grep -w LISTEN
```
Expected output:
```plaintext theme={null}
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN
```
## Installing UFW
To install UFW on app01, start by updating your package list and then installing UFW:
```bash theme={null}
apt-get update
# ... additional update output ...
apt-get install ufw
```
After installation, check the current status of UFW:
```bash theme={null}
ufw status
```
The expected output should state:
```plaintext theme={null}
Status: inactive
```
## Configuring Default Firewall Rules
Since no firewall rules are active yet, begin by setting default policies. We want to permit all outbound traffic while denying inbound connections. Execute these commands as the root user:
```bash theme={null}
ufw default allow outgoing
```
The system will confirm:
```plaintext theme={null}
Default outgoing policy changed to 'allow'
(be sure to update your rules accordingly)
```
Next, set the default rule to deny all inbound connections:
```bash theme={null}
ufw default deny incoming
```
## Defining Specific Allow Rules
Now that the default policies are in place, add rules to allow specific traffic:
1. Allow SSH connections on port 22 only from the jump server with IP address 172.16.238.5:
```bash theme={null}
ufw allow from 172.16.238.5 to any port 22 proto tcp
```
2. Allow HTTP connections on port 80 from the jump server:
```bash theme={null}
ufw allow from 172.16.238.5 to any port 80 proto tcp
```
3. Allow HTTP access on port 80 from the internal network (IP range 172.16.100.0/28):
```bash theme={null}
ufw allow from 172.16.100.0/28 to any port 80 proto tcp
```
Since port 8080 is actively listening but must be blocked, add an explicit deny rule:
```bash theme={null}
ufw deny 8080
```
Although the default policy already denies incoming connections, explicitly denying port 8080 clarifies its intended blocked status.
## Enabling UFW
Before enabling UFW, verify that all necessary rules are correctly set to avoid unintended disconnections. Once reviewed, enable UFW with:
```bash theme={null}
ufw enable
```
The system warns that enabling UFW may disrupt existing SSH connections. Confirm by entering “y” when prompted:
```plaintext theme={null}
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
```
After UFW is enabled, check its status:
```bash theme={null}
ufw status
```
Expected output:
```plaintext theme={null}
Status: active
To Action From
-- ----- ----
22/tcp ALLOW 172.16.238.5
80/tcp ALLOW 172.16.238.5
80/tcp ALLOW 172.16.100.0/28
8080 DENY Anywhere
8080 (v6) DENY Anywhere (v6)
```
## Deleting Firewall Rules
To remove a specific rule, such as the deny rule for port 8080, use the following command:
```bash theme={null}
ufw delete deny 8080
```
The system confirms the deletion:
```plaintext theme={null}
Rule deleted
Rule deleted (v6)
```
Alternatively, you can delete rules based on their line numbers listed in the firewall status. For example, if the deny rule for port 8080 is listed as rule number 5 and then as rule number 4, delete them one by one:
```bash theme={null}
ufw delete 5
# Confirm deletion when prompted, then:
ufw delete 4
```
After removing rules, recheck the status:
```bash theme={null}
ufw status
```
The updated rules should appear as follows:
```plaintext theme={null}
Status: active
To Action From
-- ----- ----
22/tcp ALLOW 172.16.238.5
80/tcp ALLOW 172.16.238.5
80/tcp ALLOW 172.16.100.0/28
8080 DENY Anywhere
```
## Summary
This lesson provided a comprehensive guide to configuring UFW on an Ubuntu server to secure SSH and HTTP traffic while blocking unauthorized connections. By setting default policies and specifying clear allow/deny rules, you can effectively manage your server's firewall and maintain a secure environment.
Practice these UFW commands to solidify your understanding and ensure your server remains protected against unwanted network traffic.