UFW

This documentation contains various notes on setting up and configuring ufw firewall on a Debain server. (At the time of writing, based on Debian 13.)

UFW is most useful for servers that don’t have an external firewall in front of them (like RackNerd).

Attention

Let the bootstrap script do the work for you!

Don’t bother doing this manually, our Debian bootstrap script can do this for you if you’re setting up a fresh Debian server. Check the script’s README for details and instructions.

Install and Configure UFW

1. SSH into the Debian server with a sudo-capable account.

2. Update source repos:

sudo apt update

3. Install ufw:

sudo apt install ufw

4. Enable IPv6 in UFW:

   1. Open the UFW default config:

   sudo nano /etc/default/ufw
   

   2. Find the line that says IPV6=, and make sure it’s set to IPV6=yes.

   3. Save and close the file with Ctrl+X, Y to confirm, and Enter to select the save location.

5. Set up default policies - deny all incoming communication and allow all outgoing communication:

sudo ufw default deny incoming
sudo ufw default allow outgoing

6. Allow SSH connections (so that you don’t get locked out!)

   1. If SSH is running on the standard port:

   sudo ufw allow 22
   

   2. If SSH is running on a non-standard port:

   sudo ufw allow [port]
   

7. Enable the firewall:

sudo ufw enable

Hint

When you first enable UFW, you’ll receive a warning Command may disrupt existing ssh connections. Proceed with operation (y|n)?.

Since we already deliberately added a rule to allow SSH, continue on with Y.

8. Check that everything looks good:

sudo ufw status verbose

9. Try logging in from a new SSH session, just to make sure that you can still get in.

These steps were adapted from a guide posted by DigitalOcean.

UFW Cheat Sheet

Can’t remember a command? Check out this UFW cheat sheet posted by DigitalOcean.