Firewall in Linux: ufw and nftables

A firewall decides which network connections to allow and which to drop; ufw is a simple way to manage it.

Common cases

sudo ufw status             # is it on, and what rules
sudo ufw enable             # turn the firewall on
sudo ufw allow 22/tcp       # allow ssh
sudo ufw allow 80,443/tcp   # allow the web
sudo ufw deny 23            # block a port
sudo ufw delete allow 80    # remove a rule

How it works: ufw on top of nftables

The kernel holds the actual rules in nftables (formerly iptables), but its syntax is verbose. ufw (uncomplicated firewall) is a simple wrapper: you say 'allow port 22' and it generates the engine's rules. The basic approach is to deny all incoming traffic and open only the ports you need (ssh, web). Before you turn the firewall on for a remote server, always allow 22/tcp, or you lock yourself out of ssh. To see what is listening on ports, use ss -tuln.

In the book

This topic is covered in full in the chapter Host security.

See also

Sockets: ss, ip addr and ip link.