How to Set Up a UFW Firewall on a Linux VPS

Setting up a firewall is a crucial step in securing your Linux VPS, and UFW (Uncomplicated Firewall) provides a user-friendly way to manage your server’s network traffic. Especially designed for ease of use, UFW simplifies the process of configuring firewall rules, making it accessible even for those new to server management. This guide will walk you through the steps of setting up and configuring UFW on your Linux VPS, ensuring that your server is protected against unauthorized access while still allowing legitimate traffic to flow smoothly.

This article is part of Rackset’s Server Security guides — browse the rest of the category for more in-depth tutorials on this topic.

In this article, we will cover the essentials of UFW firewall setup, starting with installation and basic configuration. You’ll learn how to enable and disable the firewall, allow or deny specific IP addresses, and manage common service ports. By the end of this guide, you’ll have a solid understanding of how to effectively use UFW to safeguard your Linux VPS from potential threats, all while maintaining control over your server’s network interactions.

Installing UFW on Your Linux VPS

Uncomplicated Firewall (UFW) is a user-friendly interface for managing iptables firewall rules on a Linux VPS. It simplifies the process of configuring a firewall to secure your server. Follow these steps to install UFW on your Linux VPS.

Step 1: Update Your System

Before installing UFW, ensure your system’s package list is up-to-date. This helps avoid compatibility issues during installation. Run the following commands:

sudo apt update
sudo apt upgrade

Step 2: Install UFW

Once your system is updated, you can install UFW using the package manager. Use the command below to install UFW:

sudo apt install ufw

This command downloads and installs UFW and any necessary dependencies.

Step 3: Verify Installation

After installation, it’s important to verify that UFW is correctly installed. You can check the version and status of UFW using the following command:

ufw status

If UFW is installed but inactive, you’ll see a message indicating that the firewall is not running.

Step 4: Enable UFW

To start using UFW, you need to enable it. Keep in mind that enabling UFW without configuring rules may block all incoming connections. To enable UFW, execute the following command:

sudo ufw enable

After enabling, UFW will automatically start on boot, ensuring your server is protected right from startup.

Step 5: Check UFW Status

Finally, confirm that UFW is active and running by checking its status again:

sudo ufw status verbose

This command provides a detailed status, including any rules that have been set.

With UFW installed and enabled, you’re now ready to configure firewall rules to enhance your server’s security.

Setting Default Policies with UFW

Before you begin configuring specific rules for your UFW firewall setup, it’s crucial to define the default policies. These policies determine the baseline behavior of your firewall, deciding whether to allow or deny incoming and outgoing connections that don’t match any specified rules.

Step 1: Deny Incoming Connections

By default, you want to block all incoming connections to ensure that only explicitly allowed traffic can access your server. This approach minimizes the risk of unauthorized access.

Read more: How to Set Up SSH Keys and Connect to Your VPS (Linux, macOS & Windows)

If you need this service, Rackset’s team provides professional Linux VPS with full support so you can rely on the quality and get set up quickly.

• Open your terminal.
• Set the default incoming policy to deny using the following command:

sudo ufw default deny incoming

Step 2: Allow Outgoing Connections

Generally, it’s safe to allow all outgoing connections from your server. This configuration ensures that your applications and services can connect to the Internet without restrictions.

• To set the default outgoing policy to allow, enter the following command:

sudo ufw default allow outgoing

Step 3: Verify Default Policies

After setting the default policies, it’s a good practice to verify them to ensure that they are correctly configured. This verification step helps you confirm that your server’s security posture is as intended.

1. Check the status of the UFW to confirm the default policies:

sudo ufw status verbose

In the output, you should see:

• Default: deny (incoming), allow (outgoing), disabled (routed)

Conclusion

Setting default policies is a foundational step in securing your server with UFW. By denying incoming connections and allowing outgoing ones, you establish a secure baseline that can be refined with specific rules as needed. Remember to regularly review and update your firewall settings to adapt to changing security requirements.

Allowing Essential Services: SSH, HTTP, and HTTPS

When setting up a UFW firewall on your Linux VPS, it is crucial to allow essential services such as SSH, HTTP, and HTTPS. These services ensure that you can manage your server remotely and that your website is accessible to users. Here’s how you can configure UFW to allow these critical services.

Allowing SSH Access

SSH (Secure Shell) is a protocol that enables secure remote management of your server. To prevent being locked out of your VPS, it’s important to allow SSH traffic through the firewall:

sudo ufw allow ssh

This command allows traffic on port 22, the default port for SSH. If you have configured SSH to use a different port, replace “ssh” with the port number. For example, if SSH listens on port 2222, use:

sudo ufw allow 2222

Allowing HTTP Traffic

HTTP traffic is necessary for serving web pages over the Internet. To allow HTTP traffic, execute the following command:

sudo ufw allow http

This command opens port 80, which is the standard port for HTTP traffic.

Allowing HTTPS Traffic

HTTPS is crucial for secure communication over the Internet, protecting data in transit between the server and clients. To allow HTTPS traffic, use the following command:

sudo ufw allow https

This command enables traffic on port 443, the default port for HTTPS.

Summary of Commands

To summarize, the following commands will configure UFW to allow SSH, HTTP, and HTTPS traffic:

• sudo ufw allow ssh or sudo ufw allow [your SSH port]
• sudo ufw allow http
• sudo ufw allow https

Ensure these commands are executed before enabling the UFW firewall to maintain access to your server and website.

Allowing Specific Ports and IP Addresses

When setting up a UFW firewall on your Linux VPS, you may need to allow specific ports and IP addresses to ensure proper functionality of your applications and services. Below are detailed instructions on how to accomplish this using UFW commands.

Allowing Specific Ports

To allow traffic through specific ports, use the following command structure:

Read more: Linux VPS Security Checklist: 12 Steps to Harden Your Server

For projects that need guaranteed resources and full root control, a VPS is the right step up from shared hosting. With VPS hosting you get dedicated CPU/RAM, NVMe storage, a dedicated IP and high uptime, deployed in minutes.

sudo ufw allow [port number]

For example, to allow traffic on port 80, which is commonly used for HTTP, execute:

sudo ufw allow 80

You can also specify the protocol (TCP or UDP) if needed. For instance, to allow TCP traffic on port 443 (HTTPS), use:

sudo ufw allow 443/tcp

Allowing Specific IP Addresses

To permit traffic from a specific IP address, use the following command:

sudo ufw allow from [IP address]

For example, to allow traffic from IP address 192.168.1.100, enter:

sudo ufw allow from 192.168.1.100

Allowing Ports from Specific IP Addresses

If you need to allow a specific port for a particular IP address, combine the port and IP address in the command:

sudo ufw allow from [IP address] to any port [port number]

For example, to allow SSH traffic (port 22) from IP address 192.168.1.100, use:

sudo ufw allow from 192.168.1.100 to any port 22

Verifying UFW Rules

After configuring your rules, check them to ensure they are set correctly. Use the following command to list all active rules:

sudo ufw status

This command will display a list of allowed and denied connections, helping you verify that your UFW setup aligns with your security requirements.

Safely Enabling UFW Without Locking Yourself Out

Configuring a UFW firewall is crucial to securing your Linux VPS, but it’s important to do so without accidentally locking yourself out. Follow these steps to ensure a smooth setup.

Step 1: Check Current SSH Port

Before enabling UFW, confirm the SSH port your server uses. By default, SSH runs on port 22, but it might have been changed for security reasons. Use the following command to check:

sudo grep Port /etc/ssh/sshd_config

Make a note of the port number as you will need it to configure UFW rules.

Step 2: Allow SSH Connections

To prevent losing SSH access when UFW is enabled, you must allow SSH connections. Replace PORT_NUMBER with your actual SSH port:

sudo ufw allow PORT_NUMBER/tcp

This command ensures that SSH traffic is permitted through the firewall.

Step 3: Enable UFW

Once SSH access is secured, you can enable the UFW firewall with confidence:

Read more: Rackset vs Contabo: VPS & Dedicated Hosting Compared

sudo ufw enable

This command activates UFW and enforces the rules you’ve set.

For heavy workloads and maximum performance, a dedicated bare-metal server gives you an entire physical machine. Rackset’s dedicated server deliver full hardware, root access and configurable port speeds for the most demanding sites and apps.

Step 4: Review UFW Status

After enabling UFW, verify its status and the rules currently applied:

sudo ufw status verbose

Ensure that your SSH port is listed as ‘ALLOW’. This confirms that SSH connections will not be blocked.

Step 5: Test SSH Access

• Open a new terminal window.
• Attempt to connect to your server using SSH.
• If successful, your configuration is correct.
• If not, review the rules and ensure the correct port is allowed.

By carefully following these steps, you can enable UFW on your Linux VPS without risking loss of access.

Checking UFW Status and Logs

After setting up your UFW firewall on your Linux VPS, it’s important to verify its status and review logs to ensure it’s functioning as expected. This section will guide you through the steps to check UFW status and logs efficiently.

Checking UFW Status

To confirm that UFW is active and to view its current status, you can use the following command:

sudo ufw status verbose

This command provides a detailed output, showing whether UFW is active and listing all rules applied to your VPS. When using Rackset’s hosting services, you’ll find that our robust VPS infrastructure ensures consistent and reliable performance, making firewall management straightforward.

Understanding UFW Logs

UFW logs are useful for monitoring incoming and outgoing connections, helping you identify any unusual activity. By default, UFW logs are stored in the /var/log/ufw.log file. To view these logs, you can use:

sudo less /var/log/ufw.log

This command allows you to scroll through the logs to find specific entries. If you prefer real-time monitoring, you can use the tail command:

sudo tail -f /var/log/ufw.log

This will display new log entries as they are written, helping you monitor ongoing network activity closely.

Log Levels and Configuration

UFW allows you to adjust the verbosity of its logs. To change the log level, use the following command:

sudo ufw logging on

You can specify different levels such as low, medium, high, or full based on your monitoring needs. For example:

sudo ufw logging medium

Rackset’s VPS solutions provide the flexibility needed to customize your firewall settings, ensuring your server is both secure and optimally configured for your specific requirements.

Conclusion

Setting up a UFW firewall on your Linux VPS is a crucial step in securing your server and ensuring that only authorized traffic can access your services. By following the steps outlined in this guide, you can efficiently manage your firewall rules, enhancing the overall security posture of your server. UFW offers a user-friendly interface for configuring complex iptables rules, making it accessible even for those new to Linux server administration.

Implementing a robust firewall setup is just one aspect of maintaining a secure and reliable server environment. At Rackset, we provide a range of hosting solutions that offer enhanced security features, ensuring your online presence is both safe and efficient. Explore our hosting options to find the perfect fit for your needs and take the first step towards a more secure hosting experience with Rackset.

Frequently Asked Questions

What is UFW in Linux?

UFW, or Uncomplicated Firewall, is a user-friendly front-end for managing iptables firewall rules on Linux systems. It simplifies the process of configuring a firewall to secure your server.

How do I enable UFW on my Linux VPS?

To enable UFW on your Linux VPS, first ensure it is installed using `sudo apt install ufw`. Then, activate it by running the command `sudo ufw enable`.

How can I check the status of UFW?

You can check the status of UFW by executing the command `sudo ufw status`. This will display whether UFW is active and list the current rules.

Can I reset UFW to its default settings?

Yes, you can reset UFW to its default settings by using the command `sudo ufw reset`. This will disable UFW and remove all existing rules, allowing you to start fresh.

How do I allow specific ports through UFW?

To allow specific ports through UFW, use the command `sudo ufw allow `. Replace `` with the actual port number you wish to allow, such as `80` for HTTP.