Linux: Installing and Configuring UFW (Uncomplicated Firewall)

Learn how to install UFW and set up basic firewall rules on your server. Root-level access is required.

About UFW

UFW (Uncomplicated Firewall) is a command-line program that allows you to quickly define firewall rules for your server. You can:

• Allow or deny access to specific IP addresses or services (SSH, HTTP, etc.)

• Block ping (ICMP) requests

• Configure additional firewall rules as needed

UFW is available on Debian and Ubuntu distributions.

Installing UFW

1. Log in to your server via SSH.

2. Install UFW using:

apt install ufw

3. Check UFW status:

ufw status

After installation, UFW is disabled by default, allowing you to configure rules without locking yourself out.
To enable the firewall when ready:

ufw enable

Granting Access

Grant access to a specific IP

ufw allow from 192.168.1.1

To remove the rule later:

ufw delete allow from 192.168.1.1

Tip: Use line numbers for deletion:

ufw status numbered
ufw delete 4  # Deletes the fourth rule

Grant access to a subnet

ufw allow from 192.168.1.0/24

Grant access to services

List available services:

ufw app list

Allow a service (replace application with the service name, e.g., OpenSSH):

ufw allow "application"

Example – allow both HTTP and HTTPS for Apache:

ufw allow "Apache Full"

Allow SSH (port 22 by default, change if your account uses a custom port such as 7822):

ufw allow 22

Denying Access

Block a specific IP

ufw deny from 192.168.1.1

Remove the rule later:

ufw delete deny from 192.168.1.1

Block an entire subnet

ufw deny from 192.168.1.0/24

Disabling Ping (ICMP) Responses

1. Open the UFW rules file:

nano /etc/ufw/before.rules

2. Comment out ICMP configuration lines by adding # at the beginning:

# ok icmp codes for INPUT
#-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
#-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
#-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
#-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

# ok icmp code for FORWARD
#-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
#-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT
#-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT
#-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT

3. Save changes and exit the editor.

4. Reload UFW to apply the changes:

ufw reload

The server now ignores ping requests.

More Information

UFW Documentation