Turning On the Firewall

Turning on a firewall safely

The dangerous part is not the rules. It is the order.

See where you are starting from:

sudo ufw status verbose

Four commands, in this order

sudo ufw allow OpenSSH              # 1. let through what must stay
sudo ufw default deny incoming      # 2. block everything else coming in
sudo ufw default allow outgoing     # 3. let this machine reach out
sudo ufw enable                     # 4. switch it on

Do them in that order. Switch the firewall on first and you have a wall with no doors, which on a real server means cutting off the connection you would need to fix it.

Add an allow line for every service the ReadMe says this machine must provide:

sudo ufw allow 80/tcp      # a web server, for example

💡 A firewall that blocks a required service is a problem the whole time it is up. Allow first, enable second.

Checking and undoing

sudo ufw status numbered     # every rule, with a number next to it
sudo ufw delete 3            # remove rule number 3

Try it yourself

sudo ufw status verbose      # before
sudo ufw allow OpenSSH
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable
sudo ufw status verbose      # after: it should say active