Linux · capture & filtering

ufw

the firewall, made simple

ufw — uncomplicated firewall — writes the iptables or nftables rules for you. It blocks incoming connections by default and lets you open ports by name or number, and its rules are saved and applied again at boot.

Allow SSH before you enable it: ufw allow ssh, then ufw enable.

Default

Deny incoming

allow outgoing

Open a port

ufw allow 443/tcp

or by name: ufw allow ssh

Switch on

ufw enable

and at every boot

Found on

Ubuntu, Debian

Fedora uses firewalld

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

root@netflow — bashufw

# ufw allow ssh

1Rules updated

Rules updated (v6)

2# ufw enable

Command may disrupt existing ssh connections. Proceed with operation (y|n)? y

Firewall is active and enabled on system startup

3# ufw status verbose

Status: active

Default: deny (incoming), allow (outgoing), disabled (routed)

To Action From

422/tcp ALLOW IN Anywhere

22/tcp (v6) ALLOW IN Anywhere (v6)

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

A rule for IPv4 and IPv6

ufw looked "ssh" up as port 22 and added it for both protocols at once — something iptables needs two commands for.

Turning it on

The warning is real: enabling the firewall without the SSH rule would cut you off. It is safe here because the rule was added first.

The defaults

Incoming connections are denied unless a rule allows them; outgoing ones are allowed.

The rules in force

Port 22 is open to anyone, over both IPv4 and IPv6. Nothing else is.

Switches

A switch changes how the command behaves. These are the ones used day to day; man ufw lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

enable: Turn the firewall on, now and at boot. "disable" turns it off.
status verbose: Show the state, the defaults and every rule.
allow PORT: Allow incoming connections to a port or named service.
deny PORT: Block incoming connections to a port.
limit PORT: Allow, but rate-limit repeated connections.
delete NUM: Delete a rule by its number.
--dry-run: Show the rules that would be written without applying them.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

sudo ufw allow from 192.168.1.0/24 to any port 22

Allows SSH only from the local network.

sudo ufw status numbered

Lists rules with numbers, for deleting.

sudo ufw delete 2

Deletes rule number 2.

sudo ufw limit ssh

Allows SSH but blocks an address that connects too often — a simple brake on password guessing.

In cybersecurity

The value of ufw is that a correct default-deny firewall takes three commands.

Open as little as possible

Each allowed port is a service exposed. Restrict administrative ports to the addresses that need them rather than to Anywhere.

Docker bypasses it

Ports published by Docker containers are opened by Docker’s own rules and are reachable even when ufw says otherwise. Bind them to 127.0.0.1 or filter in the DOCKER-USER chain.

Check from outside

A firewall rule is a claim. Scanning the machine from another host with nmap is the proof.

Protocols it shows

TCP UDP IPv4 IPv6

Read alongside

iptablesThe long-standing Linux firewall command: lists and edits the rules that accept or drop packets.nftReads and edits the kernel packet filter — the tables, chains and rules that decide which packets a host accepts, forwards or drops.