Skip to content
Browse

/cheatsheets/ufw/ufw-cheat-sheet

ufw cheat sheet: enable, allow, deny, delete and route rules

The commands on this page have not been executed by our verification runner yet.updated
tool
ufw
versions
ufw 0.36
os
linux

ufw (Uncomplicated Firewall) is the front end for iptables/nftables on Ubuntu and Debian. Every command needs sudo. The safe order on a remote server is: allow SSH, then enable: sudo ufw allow OpenSSH && sudo ufw enable. Rules apply immediately and survive reboots.

Status and switching on/off

CommandEffect
sudo ufw statusActive or inactive, and the rules
sudo ufw status verboseAlso default policies and logging level
sudo ufw status numberedRules with numbers (for delete and insert)
sudo ufw enableActivate now and at boot (asks for confirmation over SSH)
sudo ufw disableDeactivate and remove the rules from the kernel
sudo ufw reloadReapply rules after editing files in /etc/ufw
sudo ufw resetDisable and delete all rules (backs up the old files)
sudo ufw show addedRules added, as commands, also while inactive

Default policies

bash
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw default deny routed        # forwarding; see DEFAULT_FORWARD_POLICY

Allow and deny

bash
sudo ufw allow 22/tcp
sudo ufw allow 80,443/tcp
sudo ufw allow 60000:61000/udp                         # range (protocol required)
sudo ufw allow from 203.0.113.0/24 to any port 5432 proto tcp
sudo ufw allow in on eth1 to any port 3306
sudo ufw deny from 198.51.100.7
sudo ufw reject 25/tcp                                 # answer with an error instead of dropping
sudo ufw limit 22/tcp                                  # rate-limit: 6+ connections in 30 s from one IP are denied
sudo ufw allow 'Nginx Full'                            # application profile (sudo ufw app list)
sudo ufw allow out 53                                  # outgoing rule
sudo ufw insert 1 deny from 192.0.2.66                 # put a rule first

Delete rules

bash
sudo ufw status numbered
sudo ufw delete 3                   # by number (asks for confirmation)
sudo ufw delete allow 80/tcp        # by the same rule text used to add it
sudo ufw --force delete 3           # no prompt (scripts)

Numbers change after each deletion; list again before deleting the next one.

Routing and comments

bash
sudo ufw route allow in on wg0 out on eth0
sudo ufw allow 8080/tcp comment 'staging API'

Logging

bash
sudo ufw logging on            # levels: off, low, medium, high, full
sudo journalctl -k | grep 'UFW BLOCK'

Blocked packets are logged with the prefix [UFW BLOCK] in the kernel log (/var/log/ufw.log when rsyslog is used).

Sources

Related pages

commands · ufwufw allow 22/tcp: open a port with ufwsudo ufw allow 22/tcp opens a port in the ufw firewall. Ranges, source-restricted rules, app profiles, deleting rules, and the Docker port publishing caveat.config · ufwufw DEFAULT_FORWARD_POLICY: allow routed traffic for VPNs, Docker and routersDEFAULT_FORWARD_POLICY in /etc/default/ufw is DROP, which blocks routed traffic for VPN servers and routers. Use ufw route allow, enable ip_forward, add NAT.errors · ufwufw: ERROR: Could not find a profile matching 'Nginx Full'ufw cannot find the app profile: the package that ships it, such as Ubuntu nginx, is not installed or the name differs. Check ufw app list, or allow 80,443/tcp.errors · ufwufw: ERROR: You need to be root to run this scriptufw refuses to run without root, even for ufw status. Use sudo, check the user in scripts, or allow one user to run only /usr/sbin/ufw through a sudoers rule.flags · ufwufw status numbered: list rules with numbers and delete one by numberufw status numbered lists rules with their positions so you can delete one with ufw delete NUM. Why IPv6 rules need a separate delete and numbers shift.