Configuring UFW on Ubuntu for a Web Server: A Step-by-Step Guide

Hardening Ubuntu Guide

We use Ubuntu as the base OS for our appliances for SOC365 and our Managed Wazuh SIEM. This article forms part of an ongoing series of articles on hardening Ubuntu.

Uncomplicated Firewall (UFW) is a user-friendly interface for managing iptables firewall rules in Ubuntu. It simplifies the process of configuring a firewall to secure your web server. In this article, we will walk you through the steps to configure UFW on an Ubuntu server to restrict inbound traffic to HTTP, HTTPS, and SSH, and limit outbound traffic to DNS requests to the Quad9 project and updates from Ubuntu update servers. Furthermore, we will restrict outbound connections to established connections and the Ubuntu update servers.

Step 1: Installing UFW

UFW is typically installed by default on Ubuntu. However, if it is not installed, you can install it using the following command:

sudo apt update
sudo apt install ufw

Step 2: Setting Up Default Policies

First, we need to set the default policies to deny all incoming traffic and allow all outgoing traffic. This is a secure default policy:

sudo ufw default deny incoming
sudo ufw default allow outgoing

Step 3: Allowing Essential Inbound Traffic

Next, we will allow inbound traffic for SSH (port 22), HTTP (port 80), and HTTPS (port 443):

sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https

Step 4: Restricting Outbound Traffic

Now, we need to restrict outbound traffic. By default, UFW allows all outbound traffic, but we will change this to deny all outbound traffic and then explicitly allow the necessary ones.

First, set the default policy to deny all outbound traffic:

sudo ufw default deny outgoing

Next, allow DNS requests to the Quad9 DNS servers. Quad9's IP addresses are 9.9.9.9 and 149.112.112.112:

sudo ufw allow out to 9.9.9.9 port 53 proto udp
sudo ufw allow out to 9.9.9.9 port 53 proto tcp
sudo ufw allow out to 149.112.112.112 port 53 proto udp
sudo ufw allow out to 149.112.112.112 port 53 proto tcp

Allow the server to get updates from Ubuntu update servers. Ubuntu update servers use HTTP (port 80) and HTTPS (port 443). To ensure we're targeting the correct servers, we can allow traffic to the known IP ranges for Ubuntu update servers:

sudo ufw allow out to 91.189.88.0/24 port 80 proto tcp
sudo ufw allow out to 91.189.88.0/24 port 443 proto tcp
sudo ufw allow out to 91.189.95.0/24 port 80 proto tcp
sudo ufw allow out to 91.189.95.0/24 port 443 proto tcp

Step 5: Enabling UFW

After configuring the rules, we can enable UFW:

sudo ufw enable

You will be prompted to confirm enabling the firewall. Type y and press Enter.

Step 6: Verifying the Configuration

To verify that UFW is configured correctly, use the following command to check the status and the active rules:

sudo ufw status verbose

The output should show that inbound traffic is allowed for SSH, HTTP, and HTTPS, while outbound traffic is restricted to DNS requests to Quad9, Ubuntu update servers, and established connections.

Example output:

Status: active
Logging: on (low)
Default: deny (incoming), deny (outgoing), allow (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22                         ALLOW IN    Anywhere                  
80                         ALLOW IN    Anywhere                  
443                        ALLOW IN    Anywhere                  

To                         Action      From
--                         ------      ----
53/tcp                     ALLOW OUT   Anywhere on 9.9.9.9        
53/udp                     ALLOW OUT   Anywhere on 9.9.9.9        
53/tcp                     ALLOW OUT   Anywhere on 149.112.112.112
53/udp                     ALLOW OUT   Anywhere on 149.112.112.112
80                         ALLOW OUT   91.189.88.0/24            
443                        ALLOW OUT   91.189.88.0/24            
80                         ALLOW OUT   91.189.95.0/24            
443                        ALLOW OUT   91.189.95.0/24            
                 

Summary

By following these steps, you have successfully configured UFW on your Ubuntu server to restrict inbound traffic to HTTP, HTTPS, and SSH, while also allowing essential outbound traffic for DNS queries to Quad9 and updates from Ubuntu update servers. This configuration helps in securing your web server by limiting the traffic to only what is necessary for its operation. By further restricting outbound connections to established connections and specific update servers, you enhance the security posture of your server, reducing the risk of unauthorized data exfiltration and malicious outbound traffic.

‍