A firewall decides which network connections are allowed to reach your machine. UFW (“Uncomplicated Firewall”) is a friendly front end for the Linux packet filter, and it is the standard tool on Ubuntu and Debian practice images. Configure it only on your own practice VM, and take a snapshot first.

The default-deny idea

A good firewall policy starts by blocking everything coming in, then allows only the traffic you need. Outgoing traffic is usually allowed so updates and browsing still work.

sudo apt install ufw                 # if it is not already installed
sudo ufw default deny incoming
sudo ufw default allow outgoing

These two lines set the baseline rules but do nothing until UFW is enabled.

Adding rules

Allow only the services the scenario requires:

sudo ufw allow 22/tcp            # SSH, only if remote access is required
sudo ufw allow 80/tcp            # web server, only if one is hosted
sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp   # limit SSH to a subnet
sudo ufw limit 22/tcp            # allow SSH but rate-limit repeated attempts
sudo ufw deny 23/tcp             # explicitly block telnet

Application profiles also exist: sudo ufw app list shows names like “OpenSSH”, and sudo ufw allow OpenSSH uses them.

Important: if you are connected over SSH, allow SSH before you enable UFW, or you will cut off your own session. On a local VM console this is less risky, but it is still a good habit.

Turning it on and checking it

sudo ufw enable                  # start the firewall now and at boot
sudo ufw status verbose          # show default policy and rules
sudo ufw status numbered         # show rules with numbers
sudo ufw delete 3                # remove rule number 3
sudo ufw logging on              # record blocked connections
sudo ufw reload                  # re-read rules

Scoring engines commonly check that UFW is active and that the default incoming policy is deny. Verify with sudo ufw status verbose and look for “Status: active” and “Default: deny (incoming)”.

Testing your work

After applying rules, confirm your services still work for allowed ports. Compare the open ports from sudo ss -tulpn with the rules in UFW: every listening service should be either intentionally allowed or shut off. Blocked connection attempts are written to /var/log/ufw.log, which is useful reading in the log-analysis lesson. Remember a firewall is one layer; it does not replace removing unneeded services and fixing weak passwords.

Check your understanding

What does sudo ufw default deny incoming do?

  • Allows all incoming connections
  • Sets the baseline to block incoming traffic unless a rule allows it
  • Disables the firewall
  • Deletes all rules

Answer: Sets the baseline to block incoming traffic unless a rule allows it Default deny means only explicitly allowed traffic can reach the machine.

Why allow SSH before enabling UFW on a machine you manage remotely?

  • UFW requires SSH
  • Otherwise the firewall may block your own session
  • SSH is always unsafe
  • It speeds up the firewall

Answer: Otherwise the firewall may block your own session Enabling default-deny without an SSH rule would drop your remote connection.

Which command shows the active rules and default policies?

  • sudo ufw status verbose
  • sudo ufw logging on
  • sudo ufw reload
  • sudo ufw app list

Answer: sudo ufw status verbose It prints whether UFW is active, the default policies, and every rule.

What does sudo ufw limit 22/tcp do?

  • Blocks SSH permanently
  • Allows SSH but rate-limits repeated connection attempts
  • Limits the file size of SSH logs
  • Opens every port

Answer: Allows SSH but rate-limits repeated connection attempts It helps slow down repeated failed logins while keeping SSH available.

PreviousNext