Configure UFW Firewall on Ubuntu

UFW (Uncomplicated Firewall) is a user-friendly interface for managing iptables firewall rules on Ubuntu. This guide covers essential UFW commands for securing your server.

Check UFW Status

$ufw status verbose

If UFW is inactive, the output shows:

Status: inactive

Enable UFW

[!WARNING] Always add an SSH allow rule before enabling UFW. Otherwise you will lock yourself out.

$ufw allow OpenSSH
$ufw enable

Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup

Common Allow Rules

Allow by Application Profile

$ufw allow 'Nginx Full'    # Ports 80 and 443
$ufw allow 'Apache Full'   # Ports 80 and 443
$ufw allow OpenSSH         # Port 22

List available application profiles:

$ufw app list

Allow by Port Number

$ufw allow 3306/tcp    # MySQL
$ufw allow 5432/tcp    # PostgreSQL
$ufw allow 6379/tcp    # Redis
$ufw allow 27017/tcp   # MongoDB

Allow from a Specific IP

$ufw allow from 203.0.113.10 to any port 22
$ufw allow from 10.0.1.0/24 to any port 3306

Deny Rules

$ufw deny 23/tcp     # Block Telnet
$ufw deny from 192.168.1.100   # Block a specific IP

Delete Rules

List rules with numbers:

$ufw status numbered

Status: active

     To                         Action      From
     --                         ------      ----
[ 1] OpenSSH                    ALLOW IN    Anywhere
[ 2] Nginx Full                 ALLOW IN    Anywhere
[ 3] 3306/tcp                   ALLOW IN    Anywhere

Delete rule number 3:

$ufw delete 3

View UFW Logs

$tail -f /var/log/ufw.log

Apr 24 10:00:01 server kernel: [UFW BLOCK] IN=eth0 OUT= MAC=... SRC=192.168.1.100 DST=45.77.x.x PROTO=TCP DPT=3306

Reset UFW

To remove all rules and start fresh:

$ufw reset

[!NOTE] UFW rules are persistent across reboots. You do not need to re-add rules after restarting the server.