UFW (Uncomplicated Firewall) Cheatsheet

UFW (Uncomplicated Firewall) provides a user-friendly way to manage IPv4 and IPv6 host-based firewalls. It acts as a frontend for iptables or nftables.

Installation

UFW is pre-installed on Ubuntu. On other distributions:

# Debian
sudo apt install ufw
 
# Arch Linux
sudo pacman -S ufw

Basic Commands

sudo ufw status                    # Check firewall status (active/inactive)
sudo ufw status verbose            # Show status with default policies and rules
sudo ufw status numbered           # Show rules with numbered IDs (for deletion)
sudo ufw enable                    # Enable the firewall (persists across reboots)
sudo ufw disable                   # Disable the firewall
sudo ufw reload                    # Reload configuration
sudo ufw reset                     # Reset all rules to defaults and disable UFW

Default Policies

sudo ufw default deny incoming     # Deny all incoming traffic (recommended)
sudo ufw default allow outgoing    # Allow all outgoing traffic (recommended)
sudo ufw default deny routed       # Deny all forwarded/routed traffic

Allowing Connections

sudo ufw allow 22                  # Allow SSH (port 22, both TCP and UDP)
sudo ufw allow ssh                 # Allow SSH by service name (same as above)
sudo ufw allow 80/tcp              # Allow HTTP (TCP only)
sudo ufw allow 443/tcp             # Allow HTTPS (TCP only)
sudo ufw allow 53/udp              # Allow DNS queries (UDP only)
sudo ufw allow 6000:6007/tcp       # Allow a port range (ports 6000 through 6007)

Denying Connections

sudo ufw deny 23                   # Deny Telnet (port 23)
sudo ufw deny 3306                 # Deny MySQL from external access

Advanced Rules

# Allow from a specific IP address
sudo ufw allow from 192.168.1.100
 
# Allow from a subnet
sudo ufw allow from 192.168.1.0/24
 
# Allow a specific IP to a specific port
sudo ufw allow from 192.168.1.100 to any port 22
 
# Allow a specific IP to a specific port on a specific interface
sudo ufw allow in on eth0 from 192.168.1.100 to any port 3306
 
# Rate limiting for SSH (allows 6 connections per 30 seconds, then blocks)
sudo ufw limit ssh

Application Profiles

UFW can use application profiles defined in /etc/ufw/applications.d/.

sudo ufw app list                  # List all available application profiles
sudo ufw app info "Nginx Full"     # Show details of a specific profile
 
# Allow using an application profile
sudo ufw allow "Nginx Full"        # Allows both port 80 and 443
sudo ufw allow "Nginx HTTP"        # Allows port 80 only
sudo ufw allow "Nginx HTTPS"       # Allows port 443 only
sudo ufw allow "OpenSSH"           # Allows port 22

Deleting Rules

# Delete by rule specification (exact match)
sudo ufw delete allow 80/tcp
 
# Delete by rule number (recommended — use 'status numbered' first)
sudo ufw status numbered
sudo ufw delete 3                  # Deletes rule number 3

Logging

# Enable logging (logs to /var/log/ufw.log)
sudo ufw logging on
 
# Set logging level: off, low, medium, high, full
sudo ufw logging medium
 
# View logs
tail -f /var/log/ufw.log

Cheatsheets