Setup Ubuntu Server Firewall

The Linux kernel includes the Netfilter subsystem, which is used to manipulate or decide the fate of network traffic headed into or through your server. All modern Linux firewall solutions use this system for packet filtering.

The kernel’s packet filtering system would be of little use to administrators without a userspace interface to manage it. This is the purpose of iptables. When a packet reaches your server, it will be handed off to the Netfilter subsystem for acceptance, manipulation, or rejection based on the rules supplied to it from userspace via iptables. Thus, iptables is all you need to manage your firewall if you’re familiar with it, but many frontends are available to simplify the task.

ufw – Uncomplicated Firewall

The default firewall configuration tool for Ubuntu is ufw. Developed to ease iptables firewall configuration, ufw provides a user friendly way to create an IPv4 or IPv6 host-based firewall.

ufw by default is initially disabled. From the ufw man page:

“ufw is not intended to provide complete firewall functionality via its command interface, but instead provides an easy way to add or remove simple rules. It is currently mainly used for host-based firewalls.”

The following are some examples of how to use ufw:

  • First, ufw needs to be enabled. From a terminal prompt enter:

    sudo ufw enable

  • To open a port (ssh in this example):

    sudo ufw allow 22
    
  • Similarly, to close an opened port:

    sudo ufw deny 22
    
  • To remove a rule, use delete followed by the rule:

    sudo ufw delete deny 22
    
  • It is also possible to allow access from specific hosts or networks to a port. The following example allows ssh access from host 192.168.0.2 to any ip address on this host:

    sudo ufw allow proto tcp from 192.168.0.2 to any port 22
    

    Replace 192.168.0.2 with 192.168.0.0/24 to allow ssh access from the entire subnet.

  • ufw can be disabled by:

    sudo ufw disable

via Ubuntu Documents

Share your love

Leave a Reply

Your email address will not be published. Required fields are marked *