Uncomplicated FireWall UFW: How can I secure my System/OS by using UFW?

Documentation Tutorials
1

Uncomplicated FireWall UFW: How can I secure my System/OS by using UFW ?

1. Motivation

This Tutorial will show you how you can activate the Uncomplicated Firewall in a few seconds on your Ubuntu system.
Works and tested on version of Ubuntu: 24*, 25.* AND 26.*

Part_1 of the script ufw.sh ==> Definition of some variables

###############################################
# Version 1.2                                 #
# Date 2026-01-28                             #    
# Kay Schiller                                #
# Description: Configure UFW Firewall         #
###############################################
#
ERROR="0"
#
#------- Functions -------------------------------------------------
#
DFAULTCOLOR="\e[0m"
GREEN="\e[1;92m"
RED="\e[1;91m"
BLUE="\e[1;94m"
#

Part_2 of of the script ufw.sh ==> Loading of the functions

# Load Functions
#
. /home/$USER/Documents/USB/functions.sh
if [ $? = 0 ]
    then
    echo -e "${GREEN}Functios imported succesfully${DFAULTCOLOR}"
else
    echo -e "${RED}ERROR: Functions were not imported, check path !${DFAULTCOLOR}"
    exit
fi

Part_3 of of the script ufw.sh ==> Recommends that the user should disable the network for a safe configuration of the firewall

#------------------------------------------------------------------
echo "Is the Ethernet cable connected ? [N || n]"
# ETHERNET = 0 ?
while read ETHERNET ;
do
	if [[ $ETHERNET == "N" ]] || [[ $ETHERNET == "n" ]]; then
	echo "No the cable is not connected anymore"
	break
	#
	else
	echo "Yes, the cable is still connected !"
	fi
done
#------------------------------------------------------------------
#

Part_4 of of the script ufw.sh ==> Starts the config of UFW: reset and enable the UFW

echo "##############################"
echo "### Configure ufw          ###"
echo "##############################"
sudo ufw reset
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw enable
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
#
echo "###############################"
echo "### Stop incoming & outgoing ##"
echo "###############################"
#
sudo ufw default deny incoming
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw default deny outgoing
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
#

Part_5 of of the script ufw.sh ==> Configure DNS

echo "###############################"
echo "### Enable DNS               ##"
echo "###############################"
#
sudo ufw allow out 53
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw allow in 53
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
#

Part_6 of of the script ufw.sh ==> Configure Ports for Surfing


echo "###############################"
echo "### Enable surfing           ##"
echo "###############################"
#
sudo ufw allow out 22
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw allow out 80
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw allow out 443
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
#

Part_7 of of the script ufw.sh ==> Configures Ports for OpenVPN

In case you need no VPN, just disable or remove this part
echo "###############################"
echo "### Enable VPN-Ports         ##"
echo "###############################"
#
sudo ufw allow out 1194
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw allow out 4569
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw allow out 5060
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw allow out 51820
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
#

Part_8 of of the script ufw.sh ==> Enable logging of the UFW

echo "###############################"
echo "### Enable full logging      ##"
echo "###############################"
#
sudo ufw logging full
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw logging on
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw disable
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw reload
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw enable
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw status verbose
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi

#------- Function -------------------------------------------------
#
STATUS_LAST_CMD()
{
	if [ $1 = 0 ]
	then
    	echo -e "${GREEN}Command succesfully executed${DFAULTCOLOR}"
    	return 0
	else
    	echo -e "${RED}Error, command was not executed !${DFAULTCOLOR}"
    	return 1
	fi
}

functions.sh ==> STATUS_LAST_CMD

The script is using the function STATUS_LAST_CMD, which proves the Error-Level of a command.
Each command which is executed by a shell delivers the so called Error-Level. If the Error-Level=0 it means the previous command was executed sucessfully. In case the value is not equal to 0 it means an error occured during processing.

=> Using this simple function we can prove that the script was executed as we want to see it - successfully !

Acknowlegment

  • A big thank you to all the developer of Ubuntu !

Literature

Offical Documentation Ubuntu: UFW

How to Set Up a Firewall with UFW on Ubuntu

Offical Documentation Ubuntu: DNS

List of TCP and UDP port numbers

OpenVPN

OpenVPN - TCP and UDP

Motivation & Next Generation of a Firewall

Appendix

Some commands in case you are a beginner

    • Open a Terminal ==> press CTRL+ALT+t at the same time
    • $USER is the name of the account who logged into the system.
      We can check this with the command: whoami
      The result of whoami will plot the account name
    • cd ~ change directory, can be used to change to another directory
      cd /home/$USER/Documents
    • ls -alrth ~ will list the content of the current directory
    • mkdir ~ can generate a new directory
      mkdir /home/$USER/Documents/USB
    • gnome-text-editor filename ~ will open the file filename or
      generate filename in case it is not existing
      gnome-text-editor /home/$USER/Documents/u2f/U2F_1/sudo

The scripts in total without any interrupt

Important

Store the scripts in the follwing folder to execute them

/home/$USER/Documents/USB

functions.sh

#!/bin/bash
#
###############################################
# Version 1.9                                 #
# Date 2024-11-05                             #    
# Kay Schiller                                #
# Description: File for functions             #
#              							      #
###############################################
#
DFAULTCOLOR="\e[0m"
GREEN="\e[1;92m"
RED="\e[1;91m"
BLUE="\e[1;94m"
#
#-------------------------------------------------------------------
### Def of a function in Bash:
#function_name(){
#    ...
#    parameter_1 = $1
#    parameter_2 = $2
#    ...
#    parameter_n = $n
#    ...
#    commands
#    ...
#}
#
# Calling the function:
## function_name p1 p2 ....pn
#
### End Def of a function in Bash
#-------------------------------------------------------------------
### Def of a IF THEN ELSE in Bash
#if [ $AGE -lt 13 ]; then
#	echo "You are a kid."
#elif [ $AGE -lt 20 ]; then
#	echo "You are a teenager."
#elif [ $AGE -lt 65 ]; then
#	echo "You are an adult."
#else
#	echo "You are an elder."
#fi
### Def of a IF THEN ELSE in Bash
#------- Functions -------------------------------------------------
#
STATUS_LAST_CMD()
{
	if [ $? = 0 ]
	then
    	echo -e "${GREEN}Command succesfully executed${DFAULTCOLOR}"
    	return 0
	else
    	echo -e "${RED}Error, command was not executed !${DFAULTCOLOR}"
    	return 1
	fi
}
#
STATUS_FILE()
{
	FILE_DIR=$1
	# test -f => File exists ?
	test -f $FILE_DIR
	if [ $? = 0 ]
	then
    	#echo -e "${GREEN}FILE=$FILE_DIR exists ${DFAULTCOLOR}"
    	return 0
	else 
    	#echo -e "${RED}FILE=$FILE_DIR does not exist! ${DFAULTCOLOR}"
    	return 1
	fi
}
#
STATUS_DIR()
{
	FILE_DIR=$1
	# test -e => Dir exists ?
	test -e $FILE_DIR
	if [ $? = 0 ]
	then
    	#echo -e "${GREEN}DIR=$FILE_DIR exists ${DFAULTCOLOR}"
    	return 0
	else 
    	#echo -e "${RED}DIR=$FILE_DIR does not exist! ${DFAULTCOLOR}"
    	return 1
	fi
}

ufw.sh ==> Configue UFW by executing this script

###############################################
# Version 1.2                                 #
# Date 2026-01-28                             #    
# Kay Schiller                                #
# Description: Configure UFW Firewall         #
###############################################
#
#
ERROR="0"
#
#------- Functions -------------------------------------------------
#
DFAULTCOLOR="\e[0m"
GREEN="\e[1;92m"
RED="\e[1;91m"
BLUE="\e[1;94m"
#
# Load Functions
#
. /home/$USER/Documents/USB/functions.sh
if [ $? = 0 ]
    then
    echo -e "${GREEN}Functios imported succesfully${DFAULTCOLOR}"
else
    echo -e "${RED}ERROR: Functions were not imported, check path !${DFAULTCOLOR}"
    exit
fi
#------------------------------------------------------------------
echo "Is the Ethernet cable connected ? [N || n]"
# ETHERNET = 0 ?
while read ETHERNET ;
do
	if [[ $ETHERNET == "N" ]] || [[ $ETHERNET == "n" ]]; then
	echo "No the cable is not connected anymore"
	break
	#
	else
	echo "Yes, the cable is still connected !"
	fi
done
#------------------------------------------------------------------
#
echo "##############################"
echo "### Configure ufw          ###"
echo "##############################"
sudo ufw reset
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw enable
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
#
echo "###############################"
echo "### Stop incoming & outgoing ##"
echo "###############################"
#
sudo ufw default deny incoming
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw default deny outgoing
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
#
echo "###############################"
echo "### Enable DNS               ##"
echo "###############################"
#
sudo ufw allow out 53
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw allow in 53
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
#
echo "###############################"
echo "### Enable surfing           ##"
echo "###############################"
#
sudo ufw allow out 22
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw allow out 80
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw allow out 443
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
#
echo "###############################"
echo "### Enable VPN-Ports         ##"
echo "###############################"
#
sudo ufw allow out 1194
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw allow out 4569
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw allow out 5060
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw allow out 51820
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
#
echo "###############################"
echo "### Enable Synology          ##"
echo "###############################"
#
sudo ufw allow out 5000
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw allow out 5001
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
# TCP 2049 for nfs
sudo ufw allow out 2049
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
#
echo "###############################"
echo "### Enable full logging      ##"
echo "###############################"
#
sudo ufw logging full
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw logging on
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw disable
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw reload
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw enable
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi
sudo ufw status verbose
STATUS_LAST_CMD $?; STATUS="$?"; if [ "$STATUS" != "0" ]; then ERROR="1"; fi