Using UFW as a Firewall

Uncomplicated Firewall (UFW) is a front-facing program for the more involved iptables firewall program installed in most GNU/Linux distributions. If you're reading this, I assume you know the basic steps on how to use a Linux shell and how to install software for your server. Otherwise, I recommend following Setting Up a Web Server.

How to Get It

If you followed the basic setup course, then you know that Vultr already installed ufw for you. If you don't use Vultr, then you can install it on a Debian system by running in a remote shell: 

sudo apt-get update && sudo apt-get install ufw

The first command checks to see what packages can be installed, and the second command installs ufw. It's strung together by a && to run the second command as long as the first succeeded.

First-Time Setup

ufw is an administration program, so you will need root access to use it. To make sure you don't have to keep typing sudo in all your commands, you can login to the root user by running: 

sudo su -

I'll assume you're in a root account from now on, but otherwise, remember to prepend all ufw commands with sudo.

You can check the status of ufw right now by running:

ufw status

Without any changes, it should report back Status: inactive. Let's set it up so that only connections to SSH (standardized at port 22) are allowed in, and then enable the firewall:

ufw default deny incoming # block all incoming connections by default
ufw allow in ssh # or: ufw allow in 22
ufw enable

With the firewall enabled and allowing only SSH in, all other ports are prortected from incoming requests. To view all your rules, run: 

ufw status verbose

A firewall that allows to connect to SSH and their website may look like:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                           Action      From
--                           ------      ----
22 (SSH)                     ALLOW IN    Anywhere
80,443/tcp (WWW Full)        ALLOW IN    Anywhere
22 (SSH (v6))                ALLOW IN    Anywhere (v6)
80,443/tcp (WWW Full (v6))   ALLOW IN    Anywhere (v6)

If you want to delete e.g. the 'WWW Full' rule, run:

ufw delete allow in 'WWW Full'
ufw reload

Enabling Common Services

You have blocked all incoming ports but SSH, which means no outsiders would be able to access other services, like an email server or your website. You should look at the ports your services are open on and enable them individually. Here is a list of a few common services:

Websites: HTTP and HTTPS

ufw allow in 'WWW Full'
ufw reload

Email: IMAP, POP3, and SMTP

ufw allow in IMAPS
ufw allow in POP3
ufw allow in SMTP
ufw allow in 'Postfix SMTPS'
ufw allow in 'Mail Submission'
ufw reload

Everything Else

You can view all applications ufw knows about by running:

ufw app list

Fine-Tuning Rules

Instead of denying all ports by default, you may want to deny (ignores incoming requests) or reject (explicitly tells requests they're not allowed):

ufw default allow in
ufw deny in PORT
ufw reject in PORT
ufw reload

You can add rules to comments to remember what they are there for:

ufw allow in PORT comment 'Secret SSH'
ufw reload
ufw status verbose

Output:

To                         Action      From
--                         ------      ----
PORT                       ALLOW IN    Anywhere                   # Secret SSH
PORT (v6)                  ALLOW IN    Anywhere (v6)              # Secret SSH

To deny outgoing ports:

ufw deny out PORT

Ratelimiting is useful to protect against brute-force login attacks, like in SSH. Only IPv4 is supported for now. Enable it by running:

ufw limit PORT/tcp

To blocklist IP addresses:

ufw deny from IP_ADDRESS

To read more what you can do with ufw, run:

man ufw

Further Reading

Contributor - shunter.xyz