Ufw stands for Uncomplicated Firewall, and is a program for managing a netfilter firewall on Linux. It provides a command line interface and aims to be uncomplicated and easy to use.

A very simplistic configuration which will deny all by default.

The next line is only needed once the first time you install the package:

Users needing to run a VPN such as OpenVPN or WireGuard can adjust the DEFAULT_FORWARD_POLICY variable in /etc/default/ufw from a value of DROP to ACCEPT to forward all packets regardless of the settings of the user interface. To forward for a specific interface like wg0, user can add the following line in the filter block

You may also need to uncomment

The PKG comes with some defaults based on the default ports of many common daemons and programs. Inspect the options by looking in the /etc/ufw/applications.d directory or by listing them in the program itself:

If users are running any of the applications on a non-standard port, it is recommended to simply make /etc/ufw/applications.d/custom containing the needed data using the defaults as a guide.

Example, deluge with custom tcp ports that range from 20202-20205:

Should you require to define both tcp and udp ports for the same application, simply separate them with a pipe as shown: this app opens tcp ports 10000-10002 and udp port 10003:

One can also use a comma to define ports if a range is not desired. This example opens tcp ports 10000-10002 (inclusive) and udp ports 10003 and 10009

Drawing on the Deluge/Deluge-my example above, the following will remove the standard Deluge rules and replace them with the Deluge-my rules from the above example:

It might be desirable to add ip addresses to a blacklist which is easily achieved simply by editing /etc/ufw/before.rules and inserting an iptables DROP line at the bottom of the file right above the "COMMIT" word.

ufw has the ability to deny connections from an IP address that has attempted to initiate 6 or more connections in the last 30 seconds. Users should consider using this option for services such as SSH.

Using the above basic configuration, to enable rate limiting we would simply replace the allow parameter with the limit parameter. The new rule will then replace the previous.

Change ACCEPT to DROP in the following lines:

If you use IPv6, related rules are in /etc/ufw/before6.rules.

Disabling logging may be useful to stop UFW filling up the kernel (dmesg) and message logs:

Docker in standard mode writes its own iptables rules and ignores ufw ones, which could lead to security issues. A solution can be found at https://github.com/chaifeng/ufw-docker.

If you are using KDE Plasma, you can just go to Wi-Fi & Networking > Firewall to access and adjust firewall configurations given plasma-firewall is installed.