LFCS 109 🐧 UFW — Concepts and Setup - KandZ

⏱️ Estimated read: 9 min | |

UFW (Uncomplicated Firewall) is the default firewall configuration tool on Ubuntu and Debian-based systems. It is not a replacement for the kernel’s packet filtering framework—it is a frontend. Under the hood, UFW manages iptables rules, which in turn are translated to nftables on modern kernels . The “uncomplicated” part is the CLI: instead of writing raw iptables chains, the administrator writes commands like ufw allow ssh and UFW generates the underlying rules. The LFCS exam tests the conceptual model: the default deny-incoming policy, the ordering of rules, the difference between deny and reject, and the critical safety step of allowing SSH before enabling the firewall.

Key point: UFW is disabled by default, even when installed. Before enabling it, an SSH allow rule must be added, or the administrator will be locked out of the remote server. UFW reads rules in order—the first match wins—and the default incoming policy is deny.

Why UFW exists

The iptables complexity problem. Raw iptables requires understanding tables (filter, nat, mangle), chains (INPUT, OUTPUT, FORWARD), matches (-p tcp --dport 22), and targets (-j ACCEPT). A simple rule to allow SSH is iptables -A INPUT -p tcp --dport 22 -j ACCEPT. A correct ruleset with default-deny policies requires at least four rules, plus loopback handling and established-connection tracking. UFW collapses this into ufw allow ssh .

The persistence problem. iptables rules are not persistent by default. They must be saved with iptables-save and restored at boot via netfilter-persistent or a similar mechanism. UFW handles persistence automatically: rules added with ufw are written to /etc/ufw/user.rules and applied at boot by the ufw-init script . There is no separate save step.

The application profile problem. A service like Nginx requires TCP port 80 and, optionally, TCP port 443. Apache requires the same ports but may also require additional modules. Instead of memorizing ports, UFW provides application profiles stored in /etc/ufw/applications.d/. The ufw app list command shows the available profiles, and ufw allow 'Nginx Full' opens both ports in one command .

The safety problem. Enabling a default-deny firewall on a remote server without allowing SSH first is a classic lockout scenario. UFW’s documentation and exam scenarios emphasize the correct order: add the SSH rule, then enable. The rule is stored but not enforced until ufw enable is executed .

The trade-off. UFW is simpler than iptables, but it is also less flexible. Complex scenarios—source NAT, port forwarding, custom chains, connection marking—require editing /etc/ufw/before.rules directly, which is essentially writing iptables rules in a UFW-managed file . UFW is not a replacement for iptables; it is a wrapper that covers the common cases.

a. Installing UFW and setting default policies

UFW is installed by default on Ubuntu. On Debian, it may require apt install ufw. After installation, UFW is inactive.

# Install if not present
sudo apt install ufw

# Check status (inactive by default)
sudo ufw status

# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

The default deny incoming policy blocks all inbound traffic that is not explicitly allowed. The default allow outgoing policy permits the server to initiate outbound connections—essential for package updates, DNS resolution, and outbound API calls .

The default forward policy is deny. This matters only if the server is acting as a router. For a standard server, the forward policy is irrelevant. The default routed policy is disabled .

b. Allowing SSH and enabling the firewall

The critical safety step is allowing SSH before enabling UFW. The rule can be added by service name, port number, or application profile.

# Allow SSH by service name
sudo ufw allow ssh

# Allow SSH by port number
sudo ufw allow 22/tcp

# Allow SSH via OpenSSH application profile
sudo ufw allow OpenSSH

# Verify the rule is added (before enabling)
sudo ufw show added

The ufw show added command displays the rules that will be applied when the firewall is enabled. This is the verification step: the SSH rule must be present before ufw enable is executed .

# Enable the firewall
sudo ufw enable
# Output: Firewall is active and enabled on system startup

# Verify status
sudo ufw status verbose

The verbose flag shows the default policies alongside the active rules, which confirms that the deny-incoming policy is in effect and SSH is allowed .

c. Allow, deny, reject, and limit

UFW has four rule actions. allow permits the traffic. deny drops the packet silently—the sender receives no response. reject sends an ICMP rejection message, which makes the connection fail immediately rather than timing out . The choice between deny and reject depends on whether the administrator wants the sender to know the traffic was blocked.

# Deny silently (default for unmatched traffic)
sudo ufw deny 8080

# Reject with ICMP response
sudo ufw reject auth

# Limit SSH: max 6 connections in 30 seconds per IP
sudo ufw limit ssh/tcp

The limit action is UFW’s rate-limiting mechanism. It allows the connection but denies it if a single IP attempts six or more connections within 30 seconds. This is the standard defense against SSH brute-force attacks .

Rules can be restricted by source address, destination port, and interface. The syntax follows the pattern ufw allow [in|out] [on interface] from <source> to <destination> port <port> proto <protocol>.

# Allow HTTP only on eth0
sudo ufw allow in on eth0 to any port 80 proto tcp

# Allow SSH only from a specific subnet
sudo ufw allow from 10.0.1.0/24 to any port 22

# Deny a specific IP
sudo ufw deny from 203.0.113.50

Complete Example Session

# ============================================
# PART 1: CHECK STATUS
# ============================================

sudo ufw status
# Output: Status: inactive

# ============================================
# PART 2: SET DEFAULT POLICIES
# ============================================

sudo ufw default deny incoming
sudo ufw default allow outgoing

# ============================================
# PART 3: ALLOW SSH BEFORE ENABLING
# ============================================

sudo ufw allow ssh
sudo ufw show added
# Output shows: ufw allow ssh

# ============================================
# PART 4: ENABLE UFW
# ============================================

sudo ufw enable
# Output: Firewall is active and enabled on system startup

# ============================================
# PART 5: VERIFY VERBOSE STATUS
# ============================================

sudo ufw status verbose
# Status: active
# Logging: on (low)
# Default: deny (incoming), allow (outgoing), disabled (routed)
# To                         Action      From
# --                         ------      ----
# 22/tcp                     ALLOW IN    Anywhere

# ============================================
# PART 6: ALLOW HTTP AND HTTPS
# ============================================

sudo ufw allow http
sudo ufw allow https

# ============================================
# PART 7: ADD RATE LIMITING FOR SSH
# ============================================

sudo ufw limit ssh/tcp
# Note: this adds a second rule for port 22.
# The existing ALLOW rule must be deleted first.
sudo ufw status numbered
# [ 1] 22/tcp    ALLOW IN    Anywhere
# [ 2] 80/tcp    ALLOW IN    Anywhere
# [ 3] 443/tcp   ALLOW IN    Anywhere
# [ 4] 22/tcp    LIMIT IN    Anywhere
sudo ufw delete 1

# ============================================
# PART 8: SOURCE-RESTRICTED RULE
# ============================================

sudo ufw allow from 10.0.1.0/24 to any port 3306 proto tcp
# Allows MySQL only from the internal subnet.

# ============================================
# PART 9: DISABLE (IF NEEDED)
# ============================================

sudo ufw disable
# Output: Firewall stopped and disabled on system startup

The nine parts trace the setup: status check, default policies, SSH allow, enable, verification, HTTP/HTTPS allow, rate limiting, source restriction, and disable.

Quick Reference

Default Policies

Policy	Command	Effect
Deny incoming	`ufw default deny incoming`	Block all inbound
Allow outgoing	`ufw default allow outgoing`	Permit outbound
Deny forward	`ufw default deny forward`	Block forwarded (default)

Rule Actions

Action	Effect
`allow`	Permit traffic
`deny`	Drop silently
`reject`	Drop with ICMP response
`limit`	Rate limit (6 connections per 30 seconds)

Basic Commands

Command	Purpose
`ufw status`	Show enabled/disabled and rules
`ufw status verbose`	Show defaults and rules
`ufw status numbered`	Show rules with numbers
`ufw enable`	Activate firewall
`ufw disable`	Deactivate firewall
`ufw show added`	Show rules that will be applied
`ufw delete <N>`	Delete rule by number
`ufw reset`	Reset to defaults

Application Profiles

Command	Purpose
`ufw app list`	List available profiles
`ufw app info <name>`	Show profile details
`ufw allow '<profile>'`	Allow by profile name

Best Practices

✅ Do This:

sudo ufw allow ssh
sudo ufw enable
<!-- Allow SSH before enabling to prevent lockout --> # ✅

sudo ufw limit ssh/tcp
<!-- Rate limit SSH to slow brute force -->          # ✅

sudo ufw show added
<!-- Verify rules before enabling -->               # ✅

❌ Don’t Do This:

# Enable UFW without allowing SSH
<!-- Locks out remote administrator -->             # ❌

# Assume UFW is enabled by default
<!-- It is disabled until ufw enable -->            # ❌

# Use deny for services that should respond with an error
<!-- reject sends ICMP; deny is silent -->          # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Locked out after enabling	SSH rule not added	Use console; `ufw disable`
Rule not taking effect	Rules are ordered, first match wins	Check `ufw status numbered`
`limit` rule not working	Existing `allow` rule precedes it	Delete the broader allow rule
Application profile not found	Profile not installed	Check `ufw app list`
IPv6 rules not applied	`IPV6` disabled in `/etc/default/ufw`	Set `IPV6=yes` and reload

Real-World Examples

1. Allow SSH

sudo ufw allow ssh

2. Allow HTTP and HTTPS

sudo ufw allow http
sudo ufw allow https

3. Allow by Profile

sudo ufw allow 'Nginx Full'

4. Rate Limit SSH

sudo ufw limit ssh/tcp

5. Source Restriction

sudo ufw allow from 10.0.1.0/24 to any port 22

6. Interface-Specific

sudo ufw allow in on eth0 to any port 80

7. Reject Instead of Deny

sudo ufw reject 23

8. Delete by Number

sudo ufw delete 3

9. View Numbered Rules

sudo ufw status numbered

10. Reset

sudo ufw reset

Visual

UFW Rule Ordering

┌──────────────────────────────────────────────┐
│  Incoming packet on port 22                  │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Rule 1: 22/tcp ALLOW IN                     │
│  ├─ Match → ACCEPT                           │
│  └─ No match → continue                      │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Rule 2: 22/tcp LIMIT IN                     │
│  (never reached if rule 1 matches)           │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Default: deny incoming                      │
└──────────────────────────────────────────────┘

The first match wins. A broad allow rule must be deleted before a limit rule can take effect.

Enable Safety Flow

┌──────────────────────────────────────────────┐
│  UFW installed (disabled)                    │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Set default deny incoming                   │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Allow SSH                                   │
│  (rule stored, not yet enforced)             │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  ufw enable                                  │
│  (rules enforced, SSH remains accessible)    │
└──────────────────────────────────────────────┘

The order is mandatory. Enabling before allowing SSH drops the administrator’s connection.

Summary

Item	Value
UFW type	Frontend for `iptables`
Default state	Disabled
Default incoming	Deny
Default outgoing	Allow
SSH safety	`ufw allow ssh` before `ufw enable`
Rule ordering	First match wins
Rate limiting	`ufw limit ssh/tcp`
Application profiles	`ufw app list`
Rule persistence	Automatic via `/etc/ufw/user.rules`

Key takeaways:

UFW is a frontend, not a separate firewall. It generates iptables rules and stores them in /etc/ufw/. The underlying kernel filtering is the same as raw iptables .
The default incoming policy is deny. This is set automatically on install. Outgoing is allowed. The forward policy is denied, which matters only for routing .
SSH must be allowed before enabling. The rule is stored but not enforced until ufw enable. This is the most common lockout scenario and the exam’s primary safety test .
The first matching rule wins. If a broad allow rule precedes a limit rule for the same port, the limit is never reached. The broader rule must be deleted .
deny is silent; reject responds. deny drops the packet without a response. reject sends an ICMP message, which makes the connection fail immediately .
Application profiles simplify common services. ufw allow 'Nginx Full' opens both HTTP and HTTPS in one command, using the profile stored in /etc/ufw/applications.d/ .

Remember: UFW is the “uncomplicated” firewall because it hides the iptables syntax, not because it changes the underlying behavior. The rules are evaluated in order, the default incoming policy is deny, and the SSH allow rule must be added before the firewall is enabled. The exam tests this sequence, not just the individual commands.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!