$ ufw rule builder

Build an ufw rule piece by piece. Copy the command. Run it.

Tip: the underlined parts are editable - click to change them right in the command.

What this does

Build the rule

Which way traffic flows. Most rules guard incoming traffic.
Limit rule to one network interface.
Restrict to TCP or UDP. Port ranges require a protocol.
ufw applies to both families by default. Picking one expresses "any" as 0.0.0.0/0 or ::/0.
Fills the destination port & protocol for you.
Source of the traffic. IP or CIDR, e.g. 192.168.1.10 or 10.0.0.0/24. Blank = any.
Source port. Rarely needed.
Destination on this host. Blank = any local address.
Port/service to match. Single (22), list (80,443), or range (1000:2000).
Label stored with the rule, shown in ufw status.

Handy reference

Actions

  • allow - permit traffic
  • deny - silently drop traffic
  • reject - drop & tell the sender
  • limit - allow but rate-limit (anti brute-force)

After you run it

  • sudo ufw status numbered - list rules
  • sudo ufw delete <num> - remove a rule
  • sudo ufw enable - turn the firewall on
  • sudo ufw reload - apply changes

Tips

  • Rules need sudo.
  • Before enabling, always allow SSH (22) so you don't lock yourself out.
  • First matching rule wins - order matters.