# Installing and configuring UFW (Uncomplicated Firewall)

> Install UFW on a Linux server and create firewall rules to allow or block IP addresses, subnets and services.

Source: https://helpcenter.ruachost.com/developers/linux/installing-and-configuring-ufw-uncomplicated-firewall/

## **Linux: Installing and Configuring UFW (Uncomplicated Firewall)**

Learn how to install **UFW** and set up basic firewall rules on your server. Root-level access is required.

#### **About UFW**

**UFW (Uncomplicated Firewall)** is a command-line program that allows you to quickly define firewall rules for your server. You can:

- Allow or deny access to specific IP addresses or services (SSH, HTTP, etc.)
- Block ping (ICMP) requests
- Configure additional firewall rules as needed

UFW is available on **Debian** and **Ubuntu** distributions.

#### **Installing UFW**

1. Log in to your server via SSH.
2. Install UFW using:

```
apt install ufw
```

3. Check UFW status:

```
ufw status
```

> After installation, UFW is **disabled** by default, allowing you to configure rules without locking yourself out.\
> To enable the firewall when ready:

```
ufw enable
```

#### **Granting Access**

##### **Grant access to a specific IP**

```
ufw allow from 192.168.1.1
```

To remove the rule later:

```
ufw delete allow from 192.168.1.1
```

**Tip:** Use line numbers for deletion:

```
ufw status numbered
ufw delete 4  # Deletes the fourth rule
```

##### **Grant access to a subnet**

```
ufw allow from 192.168.1.0/24
```

##### **Grant access to services**

List available services:

```
ufw app list
```

Allow a service (replace `application` with the service name, e.g., OpenSSH):

```
ufw allow "application"
```

Example – allow both HTTP and HTTPS for Apache:

```
ufw allow "Apache Full"
```

Allow SSH (port 22 by default, change if your account uses a custom port such as 7822):

```
ufw allow 22
```

#### **Denying Access**

##### **Block a specific IP**

```
ufw deny from 192.168.1.1
```

Remove the rule later:

```
ufw delete deny from 192.168.1.1
```

##### **Block an entire subnet**

```
ufw deny from 192.168.1.0/24
```

#### **Disabling Ping (ICMP) Responses**

1. Open the UFW rules file:

```
nano /etc/ufw/before.rules
```

2. Comment out ICMP configuration lines by adding `#` at the beginning:

```
# ok icmp codes for INPUT
#-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
#-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
#-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
#-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

# ok icmp code for FORWARD
#-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
#-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT
#-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT
#-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT
```

3. Save changes and exit the editor.
4. Reload UFW to apply the changes:

```
ufw reload
```

> The server now ignores ping requests.

#### **More Information**

[UFW Documentation](https://help.ubuntu.com/community/UFW)