How to Easily Set Up a Firewall on Debian with Uncomplicated Firewall (UFW)
Learn how to secure your Debian servers using UFW (Uncomplicated Firewall). Perfect for both beginners and experienced administrators looking to simplify their firewall management.
Securing your Debian server doesn't have to be complicated... at least, not with Uncomplicated Firewall (UFW), that is.
In this article, we'll explore what UFW is, how it works with iptables/nftables, and walk you through setting it up on your Debian system. Let's dive in.
Understanding UFW
Originally developed for Ubuntu, Uncomplicated Firewall (UFW) is designed to make configuring network traffic filtering more accessible.
Under the hood, UFW translates your commands into iptables or nftables rules, which are integral parts of the Linux kernel responsible for packet filtering and network traffic management. These tools are powerful but can be complex to configure directly. UFW simplifies this process, allowing you to implement firewall rules with straightforward commands.
For example, on nftables to allow SSH connections you could run:
iptables: A traditional firewall framework that filters packets and manages network traffic.
nftables: A modern replacement for iptables, offering improved performance and a more unified approach to packet filtering.
Starting from Debian 10 (Buster), nftables is the default backend. UFW ensures compatibility by automatically translating its commands into the appropriate iptables or nftables rules based on your system's configuration (it flawlessly works with either).
Prerequisites
Before we begin, make sure you have the following:
A Debian-based system (We recommend Debian 12, Ubuntu also works, though it's installed by default)
A user account with sudo privileges
Installing UFW on Debian
First, update your system's package list:
sudoapt update
Then, install UFW:
sudoaptinstall ufw
Basic UFW commands
Here are some basic UFW commands that you'll find useful:
Enable UFW: sudo ufw enable
Disable UFW: sudo ufw disable
Check UFW status: sudo ufw status or sudo ufw status verbose
This configuration blocks all unsolicited incoming traffic while allowing your server to initiate outgoing connections.
Allowing SSH connections
To prevent yourself from being locked out of your server, it's important to allow SSH connections, which you can do with the same command as mentioned above:
sudo ufw allow ssh
If your SSH service is running on a non-standard port (e.g., 2222), specify it like this:
sudo ufw allow 2222
Allowing specific ports
If you're running services like a web server, you'll need to allow HTTP and HTTPS traffic:
sudo ufw allow 80# HTTPsudo ufw allow 443# HTTPS
Enabling UFW
After configuring your rules, you can enable UFW:
sudo ufw enable
You'll receive a warning that enabling the firewall might disrupt existing SSH connections. Since we've already allowed SSH, it's safe to proceed. Type 'y' and press Enter.
Advanced UFW configuration
Application profiles
UFW includes profiles for common applications, making it even easier to manage firewall rules based on application names.
If you're looking for practically any kind of digital infrastructure, xTom would love to help.
We provide anything from dedicated servers to colocation, and more through our xTom brand.
Over at our V.PS brand, we provide... well, VPS. Scalable, reliable, and affordable NVMe VPS. Great for developing, hobby, or production.
Give us a look, and don't be afraid to reach out! Thanks for reading :).
Frequently asked questions (FAQs)
Is UFW suitable for production servers?
Yes, UFW is suitable for both development and production environments. It simplifies firewall management without sacrificing control or security.
How do I remove a rule in UFW?
Use the delete command followed by the rule. For example:
sudo ufw delete allow 22
Can I use UFW with other firewall tools?
It's recommended to use one firewall management tool at a time to avoid conflicts. If you prefer another tool (outside of nftables), disable UFW before proceeding.