> ## Documentation Index
> Fetch the complete documentation index at: https://kb.hosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Installing and configuring UFW (Uncomplicated Firewall)

> Learn to install UFW and configure basic rules with root access in this guide.

This article describes how to install UFW (Uncomplicated Firewall) and set up some basic configuration rules.

<Warning>
  **Important**

  You must have root-level access to the server to follow the procedures in this article.
</Warning>

## About UFW

UFW (Uncomplicated Firewall) is a command-line program that enables you to quickly define firewall access rules for your server. You can grant or deny access to IP addresses and specific services (such as SSH and HTTP), block ping requests, and more.

UFW is available in the [Debian](https://www.debian.org/) and [Ubuntu](https://ubuntu.com/) Linux distributions. The following procedures demonstrate how to install UFW and set up some basic firewall rules. For additional information, please see the [UFW documentation](http://help.ubuntu.com/community/UFW).

## Installing UFW

To install UFW on your server, follow these steps:

1. Log in to your server [using SSH](/docs/using-ssh-secure-shell).

2. At the command prompt, type the following command:

   ```bash theme={null}
   apt install ufw
   ```

3. To see the current UFW status, type the following command:

   ```bash theme={null}
   ufw status
   ```

4. After initial installation, UFW is disabled so you can configure access rules (and not lock yourself out if using an SSH connection). When you are ready to enable the firewall, type the **ufw enable** command.

## Granting access

With just a few commands you can set up rules to grant access to your server.

### Granting access to IP addresses

To grant access to a specific IP address, type the following command. Replace ***192.168.1.1*** with the IP address you want to use:

```bash theme={null}
ufw allow from 192.168.1.1
```

If you later decide you want to remove this rule, type the following command:

```bash theme={null}
ufw delete allow from 192.168.1.1
```

<Tip>
  You can also use line numbers in the **delete** command. To obtain a list of rules with their associated line numbers, type the following command:

  ```bash theme={null}
  ufw status numbered
  ```

  For example, to delete the fourth rule, type the following command:

  ```bash theme={null}
  ufw delete 4
  ```
</Tip>

### Allowing an entire subnet

To grant access to an entire subnet of IP addresses, type the following command. Replace ***192.168.1.0/24*** with the IP address and network mask you want to allow:

```bash theme={null}
ufw allow from 192.168.1.0/24
```

### Granting access to services

In addition to granting access to IP addresses, you can permit access to specific services on the server, such as SSH and HTTP. To see a list of available application services, type the following command:

```bash theme={null}
ufw app list
```

To allow access to one of those services, type the following command. Replace ***application*** with the application name (for example, **OpenSSH**):

```bash theme={null}
ufw allow "application"
```

<Note>
  Make sure you include the quotation marks around the application name.
</Note>

For example, the following command enables access for secure (HTTPS) and non-secure (HTTP) connections on Apache:

```bash theme={null}
ufw allow "Apache Full"
```

<Tip>
  * To allow access to port 22 (SSH), type the following command:

    ```bash theme={null}
    ufw allow 22
    ```

  * Make sure you use the correct SSH port number for your account. For example, some hosting accounts use a different port for SSH, such as 7822.
</Tip>

## Denying access

With just a few commands you can set up rules to deny access to your server.

### Blocking access by IP address

To deny access from a specific IP address, type the following command. Replace ***192.168.1.1*** with the IP address you want to block:

```bash theme={null}
ufw deny from 192.168.1.1
```

If you later decide you want to remove this rule, type the following command:

```bash theme={null}
ufw delete deny from 192.168.1.1
```

### Blocking an entire subnet

To deny access from an entire subnet of IP addresses, type the following command. Replace ***192.168.1.0/24*** with the IP address and network mask you want to block:

```bash theme={null}
ufw deny from 192.168.1.0/24
```

### Disabling ping (ICMP) responses

To disable sending ping (ICMP) responses from the server, follow these steps:

1. Open the */etc/ufw/before.rules* file in your preferred text editor.

2. Comment out the ICMP configuration lines by typing a **#** character at the start of each line as follows:

   ```
   # ok icmp codes for INPUT
   #-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
   #-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
   #-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
   #-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

   # ok icmp code for FORWARD
   #-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
   #-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT
   #-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT
   #-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT
   ```

3. Save your changes to the */etc/ufw/before.rules* file, and then exit the text editor.

4. Type the following command to load the new configuration:

   ```bash theme={null}
   ufw reload
   ```

The server now ignores ping requests.

## More information

To view the documentation for UFW, please visit [https://help.ubuntu.com/community/UFW](https://help.ubuntu.com/community/UFW).

## Related articles

* [Securing an unmanaged server](/docs/securing-an-unmanaged-server)

* [Configuring a firewall using iptables](/docs/configuring-a-firewall-using-iptables)

* [Installing and configuring Advanced Policy Firewall](/docs/installing-and-configuring-advanced-policy-firewall)