cyber-security-resources/cheat_sheets/UFW_cheat_sheet.md

UFW: Uncomplicated Firewall — Cheat Sheet

Installation

If you are using Ubuntu then UFW will be installed by default. If you are using Debian or a derivative, then you can install UFW by entering the following

root@host:~# apt-get install ufw

UFW is not available in CentOS, and although you can install it from source, that is outside the scope of this tutorial.

Checking status

When you check the status, UFW will either tell you that it is inactive,

root@host:~# ufw status
 Status: inactive

or it will tell you it is active and list the firewall rules.

root@host:~# ufw status
 Status: active
 To                         Action      From
 --                         ------      ----
 22/tcp                     ALLOW       Anywhere                  
 22/tcp (v6)                ALLOW       Anywhere (v6)

Rules can also be numbered, which is particularly useful when you wish to delete one.

root@host:~# ufw status numbered
 Status: active
  To                         Action      From  --                         ------      ----
 [ 1] WWW Full                   ALLOW IN    Anywhere                  
 [ 2] WWW Full (v6)              ALLOW IN    Anywhere (v6)

Not that if you have no rules enables, you will just be told it is active

root@host:~# ufw status
 Status: active

Enable and disable

Enabling and disabling are from the following commands. Warning; if you are working on a remote system, allow the SSH rule before you enable UFW or you risk losing your shell access.

root@host:~# ufw enable
 Firewall is active and enabled on system startup
root@host:~# ufw disable
 Firewall stopped and disabled on system startup

Deleting rules

The easiest way to delete a rule is to delete it by number, but you can also delete it by definition.

root@host:~# ufw status numbered
 Status: active
  To                         Action      From  --                         ------      ----
 [ 1] 22/tcp                     ALLOW IN    Anywhere                  
 [ 2] 22/tcp (v6)                ALLOW IN    Anywhere (v6)

Note that as there are 2 rules (ipv4 and ipv6) for every pre-defined service, delete will only remove the rule for one protocol.

root@host:~# ufw delete 2
 Deleting:
  allow 22/tcp
 Proceed with operation (y|n)? y
 Rule deleted (v6)

Logging

Logging is on by default, but can rapidly fill your log files with noise. Enable and disable thusly

root@host:~# ufw logging on
 Logging enabled
root@host:~# ufw logging off
 Logging disabled

You can also change the logging levels if necessary, but low is the default.

root@host:~# ufw logging medium
 Logging enabled
Pre-defined rules

One of the strengths for sysadmins who may only infrequently change firewall rules is the set of pre-defined rules that UFW ships with. These obviously assume that you are running services on default ports and will NOT work if you have tried to obfuscate by assigning non-default ports. They also assume you will be allowing ALL traffic to these port (see later for how to restrict traffic sources and destinations.

root@host:~# ufw app list
 Available applications:
   AIM
   Bonjour
   CIFS
   CUPS
   DNS
   Deluge
   IMAP
   IMAPS
   IPP
   KTorrent
   Kerberos Admin
   Kerberos Full
   Kerberos KDC
   Kerberos Password
   LDAP
   LDAPS
   LPD
   MSN
   MSN SSL
   Mail submission
   NFS
   POP3
   POP3S
   PeopleNearby
   SMTP
   SSH
   Socks
   Telnet
   Transmission
   Transparent Proxy
   VNC
   WWW
   WWW Cache
   WWW Full
   WWW Secure
   XMPP
   Yahoo
   qBittorrent
   svnserve

You can see a full list of these and their definitions in /etc/ufw/applications.d.

SSH

If you are running a remote server, you almost certainly want this rule enabled.

 root@host:~# ufw allow ssh
 Rule added
 Rule added (v6)
root@host:~# ufw status
 Status: active
 To                         Action      From
 --                         ------      ----
 22/tcp                     ALLOW       Anywhere                  
 22/tcp (v6)                ALLOW       Anywhere (v6)
http(s)

You can enable both port 80 (http) and 443 (https) in one go with the following command, but there are options to only enable one

root@host:~# ufw allow www\ full
 Rules updated
 Rules updated (v6)
root@host:~# ufw status
 [sudo] password for simon: 
 Status: active
 To                         Action      From
 --                         ------      ----
 WWW Full                   ALLOW       Anywhere                  
 WWW Full (v6)              ALLOW       Anywhere (v6) 

More complex usage

Port and protocol

root@host:~# ufw allow 45/tcp
 Rule added
 Rule added (v6)

Source and Destination

Allow only from an IP

root@host:~# ufw allow from 192.168.1.1 port 62
 Rule added
root@host:~# ufw status
 Status: active
 To                         Action      From
 --                         ------      ----
 Anywhere                   ALLOW       192.168.1.1 62

Allow only to a certain local interface

root@host:~# ufw allow to 127.0.0.2 port 62
 Rule added
root@host:~# ufw status
 Status: active
 To                         Action      From
 --                         ------      ----
 127.0.0.2 62               ALLOW       Anywhere

Protocol only

If you have followed my ipsec tutorial, you will need the firewall ports open to establish the key exchange – this is one of the few protolcols which do not require a port number.

root@host:~# ufw allow to 127.0.0.3 proto esp
 Rule added

root@host:~# ufw allow to 127.0.0.3 proto ah
 Rule added
root@host:~# ufw status
 Status: active
 To                         Action      From
 --                         ------      ----
 127.0.0.3/esp              ALLOW       Anywhere                  
 127.0.0.3/ah               ALLOW       Anywhere 

Note that you need a destination in this instance.