Learn how to secure your Debian servers using UFW (Uncomplicated Firewall). Perfect for both beginners and experienced administrators looking to simplify their firewall management.
Publish date: 11/21/2024
Securing your Debian server doesn't have to be complicated... at least, not with Uncomplicated Firewall (UFW), that is.
In this article, we'll explore what UFW is, how it works with iptables/nftables, and walk you through setting it up on your Debian system. Let's dive in.
Originally developed for Ubuntu, Uncomplicated Firewall (UFW) is designed to make configuring network traffic filtering more accessible.
Under the hood, UFW translates your commands into iptables or nftables rules, which are integral parts of the Linux kernel responsible for packet filtering and network traffic management. These tools are powerful but can be complex to configure directly. UFW simplifies this process, allowing you to implement firewall rules with straightforward commands.
For example, on nftables to allow SSH connections you could run:
sudo nft add rule inet filter input tcp dport 22 ct state new,established accept
But that same command on UFW is just:
sudo ufw allow ssh
Big difference, huh?
Starting from Debian 10 (Buster), nftables is the default backend. UFW ensures compatibility by automatically translating its commands into the appropriate iptables or nftables rules based on your system's configuration (it flawlessly works with either).
Before we begin, make sure you have the following:
sudo privilegesFirst, update your system's package list:
sudo apt update
Then, install UFW:
sudo apt install ufw
Here are some basic UFW commands that you'll find useful:
sudo ufw enablesudo ufw disablesudo ufw status or sudo ufw status verbosesudo ufw allow [port/service]sudo ufw deny [port/service]sudo ufw delete [allow/deny] [port/service]It's a good practice to start by setting your firewall to deny all incoming connections and allow all outgoing connections.
This ensures that only traffic you explicitly allow can reach your server.
sudo ufw default deny incoming
sudo ufw default allow outgoing
This configuration blocks all unsolicited incoming traffic while allowing your server to initiate outgoing connections.
To prevent yourself from being locked out of your server, it's important to allow SSH connections, which you can do with the same command as mentioned above:
sudo ufw allow ssh
If your SSH service is running on a non-standard port (e.g., 2222), specify it like this:
sudo ufw allow 2222
If you're running services like a web server, you'll need to allow HTTP and HTTPS traffic:
sudo ufw allow 80 # HTTP
sudo ufw allow 443 # HTTPS
After configuring your rules, you can enable UFW:
sudo ufw enable
You'll receive a warning that enabling the firewall might disrupt existing SSH connections. Since we've already allowed SSH, it's safe to proceed. Type 'y' and press Enter.
UFW includes profiles for common applications, making it even easier to manage firewall rules based on application names.
List available profiles:
sudo ufw app list
Allow an application by name, for example:
sudo ufw allow 'Deluge'
This command allows traffic for Deluge.
If your server uses IPv6, ensure that UFW is configured to handle IPv6 traffic.
Edit the UFW configuration file:
sudo nano /etc/default/ufw
Set the following line:
IPV6=yes
Save and close the file, then reload UFW:
sudo ufw reload
To view the current status and active rules, use:
sudo ufw status verbose
This command provides detailed information about your firewall configuration.
To temporarily disable UFW:
sudo ufw disable
To reset UFW to its default state, deleting all custom rules:
sudo ufw reset
With this article, you've learned how to set up a basic firewall that you can customize further to meet the specific needs of your environment.
It's safe to say UFW is an excellent choice for securing Debian-based systems in various scenarios, from personal servers to production environments.
It allows anyone, with little to no complexities, to set up and configure a firewall.
Why not give it a shot? Worst case scenario if you hate it, you can give nftables or iptables a go.
Note: For a full comparison of the best Linux firewalls, give this article here a read.
If you're looking for practically any kind of digital infrastructure, xTom would love to help.
We provide anything from dedicated servers to colocation, and more through our xTom brand.
Over at our V.PS brand, we provide... well, VPS. Scalable, reliable, and affordable NVMe VPS. Great for developing, hobby, or production.
Give us a look, and don't be afraid to reach out! Thanks for reading :).
Yes, UFW is suitable for both development and production environments. It simplifies firewall management without sacrificing control or security.
Use the delete command followed by the rule. For example:
sudo ufw delete allow 22
It's recommended to use one firewall management tool at a time to avoid conflicts. If you prefer another tool (outside of nftables), disable UFW before proceeding.