UFW should be already installed by default on Ubuntu 18.04 – but if for some reason is is not installed, you can install it with this command:<\/p>\n
sudo apt install ufw<\/pre>\nOnce the installation is complete, you can check the UFW status with the command:<\/p>\n
sudo ufw status verbose<\/pre>\nUFW by default is initially disabled, and if you never activated before you will get the output:<\/p>\n
Output\r\nStatus: inactive<\/pre>\nIf you already have UFW activated on your server, the output will look quite different and will look similar to the following:<\/p>\n
Output:\r\n\r\nStatus: active\r\nLogging: on (low)\r\nDefault: deny (incoming), allow (outgoing), disabled (routed)\r\nNew profiles: skip\r\n\r\nTo Action From\r\n-- ------ ----\r\n22\/tcp ALLOW IN Anywhere\r\n80\/tcp ALLOW IN Anywhere\r\n443\/tcp ALLOW IN Anywhere\r\n22\/tcp (v6) ALLOW IN Anywhere (v6)\r\n80\/tcp (v6) ALLOW IN Anywhere (v6)\r\n443\/tcp (v6) ALLOW IN Anywhere (v6)\r\n....<\/pre>\n<\/span>Step 3: UFW Default Policies<\/span><\/h2>\nThe first thing you need to know is the default policies. By default, UFW is configured to deny all incoming connections and allow all outgoing connections. In other words, all of the connections that will try to access your server will be refused and all of your applications and services that are locally found on your server will be able to reach the outside world and access other servers.<\/p>\n
If you want to check or change the default policies, you can find them in the \/etc\/default\/ufw<\/code>\u00a0configuration file.<\/p>\nTo set these UFW rules to the default, you can run the following commands:<\/p>\n
sudo ufw default deny incoming\r\nsudo ufw default allow outgoing<\/pre>\nKeep in mind that servers usually need to respond to an incoming request from Internet users. So, in most cases, you cannot set your firewall to block all incoming connections. In the next step, we’ll learn how to allow specific connections.<\/p>\n
<\/span>Step 4: Allow SSH Connections<\/span><\/h2>\nBefore you enable UFW, you need to allow SSH access on your server by adding a rule that will allow incoming SSH connections. Otherwise, you will get locked and you will not be able to connect to your Ubuntu server.<\/p>\n
You can use the following command to configure the UFW firewall to allow all incoming SSH connections:<\/p>\n
sudo ufw allow ssh<\/pre>\nThen you will receive the following output:<\/p>\n
Rules updated\r\nRules updated (v6)<\/pre>\nPlease note that this command is only if your server listens to the standardized SSH port: 22. If the SSH service uses a custom non-standard port, you will need to open that port. If the SSH service on your server uses a unique port, for example port 900, then you can use the following command:<\/p>\n
sudo ufw allow 900<\/pre>\nNote that you’ll need to know what port number your service currently uses.<\/p>\n
<\/span>Step 5: Enable UFW<\/span><\/h2>\nNow your firewall is configured to allow SSH connections and you are sure that your current SSH connection will not be affected, you can continue with enabling the UFW firewall.<\/p>\n
sudo ufw enable<\/pre>\nAfter which you will receive the following output:<\/p>\n
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y\r\nFirewall is active and enabled on system startup<\/pre>\nYou will get a warning that tells you that you need to have configured allowing SSH rules, otherwise the existing SSH connection will be closed. Since you already have, type [y] and continue with [Enter].<\/p>\n
<\/span>Step 6: Allow Connections on Specific Ports<\/span><\/h2>\nThe applications and services that you use may need to have their ports opened for incoming and outgoing connections, depending on the application’s purpose. The most common ports you’ll need to unblock are ports 80 & 443, which are used by the web server, and 25, 110, 143, 587 and 993, which are used by the mail server.<\/p>\n
We’ll show you through a few examples of how to allow incoming connections for some common services.<\/p>\n
To allow all HTTP (port 80) connections, run this command:<\/p>\n
sudo ufw allow http<\/pre>\nAlso, if you want to specify the port, you can apply what is essentially the same rule but with a different syntax:<\/p>\n
sudo ufw allow 80<\/pre>\nTo allow all HTTPS (port 443) connections, run the command:<\/p>\n
sudo ufw allow https<\/pre>\nAdditionally, if you want to specify the HTTPS port, you can apply the rule with a different syntax:<\/p>\n
sudo ufw allow 443<\/pre>\nIf you are using a mail server, some of the next rules could be useful.<\/p>\n
To allow all incoming SMTP you can run the command:<\/p>\n
sudo ufw allow 25<\/pre>\nTo allow all incoming IMAP connections, run the command:<\/p>\n
sudo ufw allow 143<\/pre>\nAnd to allow all incoming IMAPS requests, you can use the command:<\/p>\n
sudo ufw allow 993<\/pre>\nIf you are using POP3 instead, this command below will allow all incoming connections:<\/p>\n
sudo ufw allow 110<\/pre>\nAnd for all incoming POP3S requests, use this next command:<\/p>\n
sudo ufw allow 995<\/pre>\nFinally, if you are running a specific program that requires web access, you will need to enable to port specific to that program as well. For example, if you run Tomcat on your server, you will need port 8080. You can allow all incoming connections to this port with the command:<\/p>\n
sudo ufw allow <port number><\/pre>\nYou can do this for all specific ports that you may need.<\/p>\n
<\/span>Step 7: Allow Port Ranges<\/span><\/h2>\nUFW also can allow access to port ranges instead of allowing access to a single port. When you want to allow port ranges at the UFW port, you need to specify the range of the port and the protocol, either TCP or UDP.<\/p>\n
For example, if you want to allow the ports from 8069 to 8080 for both TCP and UDP, you can use the following commands:<\/p>\n
sudo ufw allow 8069:8080\/tcp\r\nsudo ufw allow 8069:8080\/udp<\/pre>\n<\/span>Step 8: Allow Specific IP Addresses<\/span><\/h2>\nIf you want to allow only one IP address (for example a trusted machine found on your local network) to be able to access all ports, you can use the command:<\/p>\n
sudo ufw allow from 206.207.208.209<\/pre>\nOn top of this, you can also allow a specific IP address to a particular port! Let’s say you want to allow a specific IP address to use the MySQL port (MySQL uses port 3306), then you can simply use this command:<\/p>\n
sudo ufw allow from 206.207.208.209 to any port 3306<\/pre>\n