Skip to main content
This article describes how to install UFW (Uncomplicated Firewall) and set up some basic configuration rules.
ImportantYou must have root-level access to the server to follow the procedures in this article.

​
About UFW

UFW (Uncomplicated Firewall) is a command-line program that enables you to quickly define firewall access rules for your server. You can grant or deny access to IP addresses and specific services (such as SSH and HTTP), block ping requests, and more. UFW is available in the Debian and Ubuntu Linux distributions. The following procedures demonstrate how to install UFW and set up some basic firewall rules. For additional information, please see the UFW documentation.

​
Installing UFW

To install UFW on your server, follow these steps:
  1. Log in to your server using SSH.
  2. At the command prompt, type the following command:
  3. To see the current UFW status, type the following command:
  4. After initial installation, UFW is disabled so you can configure access rules (and not lock yourself out if using an SSH connection). When you are ready to enable the firewall, type the ufw enable command.

​
Granting access

With just a few commands you can set up rules to grant access to your server.

​
Granting access to IP addresses

To grant access to a specific IP address, type the following command. Replace 192.168.1.1 with the IP address you want to use:
If you later decide you want to remove this rule, type the following command:
You can also use line numbers in the delete command. To obtain a list of rules with their associated line numbers, type the following command:
For example, to delete the fourth rule, type the following command:

​
Allowing an entire subnet

To grant access to an entire subnet of IP addresses, type the following command. Replace 192.168.1.0/24 with the IP address and network mask you want to allow:

​
Granting access to services

In addition to granting access to IP addresses, you can permit access to specific services on the server, such as SSH and HTTP. To see a list of available application services, type the following command:
To allow access to one of those services, type the following command. Replace application with the application name (for example, OpenSSH):
Make sure you include the quotation marks around the application name.
For example, the following command enables access for secure (HTTPS) and non-secure (HTTP) connections on Apache:
  • To allow access to port 22 (SSH), type the following command:
  • Make sure you use the correct SSH port number for your account. For example, some hosting accounts use a different port for SSH, such as 7822.

​
Denying access

With just a few commands you can set up rules to deny access to your server.

​
Blocking access by IP address

To deny access from a specific IP address, type the following command. Replace 192.168.1.1 with the IP address you want to block:
If you later decide you want to remove this rule, type the following command:

​
Blocking an entire subnet

To deny access from an entire subnet of IP addresses, type the following command. Replace 192.168.1.0/24 with the IP address and network mask you want to block:

​
Disabling ping (ICMP) responses

To disable sending ping (ICMP) responses from the server, follow these steps:
  1. Open the /etc/ufw/before.rules file in your preferred text editor.
  2. Comment out the ICMP configuration lines by typing a # character at the start of each line as follows:
  3. Save your changes to the /etc/ufw/before.rules file, and then exit the text editor.
  4. Type the following command to load the new configuration:
The server now ignores ping requests.

​
More information

To view the documentation for UFW, please visit https://help.ubuntu.com/community/UFW.