🔗Status and Control
| Task | Command |
|---|---|
| Show status and active rules | ufw status |
| Show status with rule numbers | ufw status numbered |
| Show verbose status (defaults, logging) | ufw status verbose |
| Enable firewall | ufw enable |
| Disable firewall | ufw disable |
| Reload rules without disabling | ufw reload |
| Reset to factory defaults (disables UFW) | ufw reset |
🔗Allow Rules
| Task | Command |
|---|---|
| Allow port (TCP + UDP) | ufw allow 53 |
| Allow port TCP only | ufw allow 22/tcp |
| Allow port UDP only | ufw allow 53/udp |
| Allow port range | ufw allow 6000:6007/tcp |
| Allow by service name | ufw allow ssh |
| Allow from any IP to any port | ufw allow from any |
| Allow from specific IP | ufw allow from 192.168.1.10 |
| Allow from IP to specific port | ufw allow from 192.168.1.10 to any port 22 |
| Allow from subnet | ufw allow from 10.0.0.0/8 |
| Allow from subnet to port | ufw allow from 10.0.0.0/8 to any port 443 |
| Allow to specific interface | ufw allow in on eth0 to any port 80 |
| Allow to specific interface and IP | ufw allow in on eth0 from 192.168.1.0/24 |
🔗Deny and Reject Rules
| Task | Command |
|---|---|
| Deny port | ufw deny 23/tcp |
| Deny from IP | ufw deny from 203.0.113.5 |
| Deny from subnet | ufw deny from 203.0.113.0/24 |
| Reject port (sends RST, not silent drop) | ufw reject 23/tcp |
| Reject from IP | ufw reject from 203.0.113.5 |
🔗Limit (Rate Limiting)
Limits connections to 6 per 30 seconds from a single IP. Useful for SSH brute-force mitigation.
| Task | Command |
|---|---|
| Limit port | ufw limit 22/tcp |
| Limit by service name | ufw limit ssh |
🔗Delete Rules
| Task | Command |
|---|---|
| Delete by rule number | ufw delete 3 |
| Delete by rule specification | ufw delete allow 80/tcp |
| Delete deny rule | ufw delete deny 23 |
To get rule numbers: ufw status numbered
🔗Default Policies
Set the default behaviour for traffic that matches no explicit rule.
| Task | Command |
|---|---|
| Default deny incoming | ufw default deny incoming |
| Default allow outgoing | ufw default allow outgoing |
| Default deny outgoing | ufw default deny outgoing |
| Default deny forwarded | ufw default deny routed |
Recommended baseline:
ufw default deny incoming
ufw default allow outgoing🔗Application Profiles
UFW ships with named profiles for common services stored in /etc/ufw/applications.d/.
| Task | Command |
|---|---|
| List available profiles | ufw app list |
| Show profile details | ufw app info Nginx |
| Allow by profile | ufw allow 'Nginx Full' |
| Deny by profile | ufw deny 'Nginx Full' |
| Update profiles after package install | ufw app update all |
🔗IPv6
Ensure IPV6=yes is set in /etc/default/ufw to apply rules to IPv6 as well. Rules apply to both stacks by default once enabled.
Allow on IPv6 only:
ufw allow in on eth0 from fe80::/10 to any port 22🔗Logging
| Task | Command |
|---|---|
| Enable logging (low level) | ufw logging on |
| Set log level | ufw logging low / medium / high / full |
| Disable logging | ufw logging off |
Logs go to /var/log/ufw.log and syslog. Format: [UFW BLOCK] or [UFW ALLOW].
🔗Common Baselines
######### Server Baseline
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw enable######### Web Server
ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp######### Allow LAN, Block WAN
ufw allow from 192.168.0.0/16
ufw deny from any######### Restrict Outbound DNS to One Resolver
ufw default deny outgoing
ufw allow out to 9.9.9.9 port 53
ufw allow out to any port 80
ufw allow out to any port 443🔗Inserting Rules at a Specific Position
Rules are matched in order. Insert before existing rules with:
ufw insert 1 allow from 10.0.0.1🔗Flags and Options
| Flag | Description |
|---|---|
allow | Permit matching traffic |
deny | Drop matching traffic silently |
reject | Drop and send RST to sender |
limit | Rate-limit (6 connections per 30s per IP) |
in | Apply to incoming traffic |
out | Apply to outgoing traffic |
on <iface> | Restrict rule to a network interface |
from <ip> | Match source address |
to <ip> | Match destination address |
port <n> | Match destination port |
proto tcp/udp | Match protocol |