Configuring the UFW Firewall

Introduction

Imagine your computer as a house. By default, the doors and windows might be open, allowing anyone to enter. To secure it, you need a security guard who controls access based on a set of rules.

In Linux, UFW (Uncomplicated Firewall) acts as this security guard. It is designed to be an easier interface on top of lower-level firewall systems. UFW lets you define who can connect to your system and who cannot.

That distinction is important: UFW is a management layer, not the firewall engine itself. It gives beginners a simpler policy interface for controlling network access without writing lower-level packet-filter rules directly.

However, configuring a firewall in a cloud environment like LabEx requires caution. If you block all incoming connections by default (which is a common security practice), you might accidentally disconnect yourself from the lab environment.

In this lab, you will adopt a safe approach:

1. Set the default policy to Allow Incoming connections to prevent lockout.
2. Explicitly allow traffic on port 8080 for a web application.
3. Enable the firewall.

This process ensures you can learn how to manage UFW rules without losing access to your workspace.

Check Firewall Status

Before making any changes, it is important to understand the current state of both your application and the firewall.

We have a simple web server running on port 8080. First, verify that the application is accessible.

Run the following command:

curl -I 127.0.0.1:8080

You should see an HTTP response similar to this:

HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/3.10.6
...

This confirms that the web application is running and reachable locally.

Checking the service before changing the firewall helps separate two different problems: application problems and network-policy problems. If the service already fails locally, the firewall is not the first thing to blame.

Next, check the status of UFW to see if it is currently active.

sudo ufw status

You will likely see:

Status: inactive

This indicates that UFW is installed but not currently enforcing any rules. It allows all traffic to pass through freely.

A firewall rule set is really a network access policy. "Inactive" does not mean the software is broken; it means the policy is not currently being enforced.

Configure Default Policy and Rules

Now, we will configure how the firewall handles traffic.

Set Default Policy to Allow

By default, UFW is often configured to deny all incoming connections. In a local machine, this is secure. However, in the LabEx online environment, blocking all incoming connections can sever the connection between your browser and the lab.

To prevent this, set the default policy for incoming traffic to ALLOW:

sudo ufw default allow incoming

Output:

Default incoming policy changed to 'allow'
(be sure to update your rules accordingly)

Allow Port 8080

Next, create a specific rule to ensure that traffic to our web application on port 8080 is explicitly allowed. This is good practice even if the default policy is "allow", as it documents your intent and prepares the configuration for a future where you might switch the default to "deny".

This idea of explicit intent matters in security. A clear rule makes it easier to understand later why a port is open and whether that exposure is still necessary.

sudo ufw allow 8080

The system will confirm:

Rules updated
Rules updated (v6)

We have now established a safe baseline configuration and added a specific rule for our application.

Enable the Firewall

With the rules configured, it is time to activate the firewall.

Run the following command to enable UFW:

sudo ufw enable

Since we set the default policy to ALLOW, UFW activates immediately without warning you that the SSH connection might be disrupted (which is a common warning when the default is deny).

You should see:

Firewall is active and enabled on system startup

This effectively "turns on" the security guard.

At this point, UFW is no longer just storing rules; it is enforcing them. That distinction between configured policy and active policy is a common security concept across many systems.

Verify Firewall Configuration

Finally, verify that the firewall is active and the rules are correctly applied.

Check the status again:

sudo ufw status

You should now see the status as active, along with the rules you created:

Status: active

To                         Action      From
--                         ------      ----
8080                       ALLOW       Anywhere
8080 (v6)                  ALLOW       Anywhere (v6)

Test Connectivity

Ensure that the web application is still accessible with the firewall enabled.

curl -I 127.0.0.1:8080

You should receive the same HTTP/1.0 200 OK response as before.

This confirms that:

1. The firewall is active.
2. The rules are working as expected.
3. The application remains accessible.

Summary

In this lab, you successfully configured and enabled the UFW firewall.

You learned how to:

1. Check Firewall Status: Use sudo ufw status to see if the firewall is active.
2. Configure Safe Defaults: Use sudo ufw default allow incoming to prevent accidental lockouts in cloud environments.
3. Add Rules: Use sudo ufw allow 8080 to permit traffic on specific ports.
4. Enable Firewall: Use sudo ufw enable to activate the rules.

In a production environment, you would typically set the default policy to deny incoming traffic and explicitly allow only the necessary ports (like 22 for SSH, 80 for HTTP, etc.). However, understanding how to manage these rules safely is the first step in securing your system.