Prerequisites and Default Policies
Before configuring specific rules, it is essential to understand how Uncomplicated Firewall (UFW) handles traffic by default. On most Ubuntu systems, the default incoming policy is set to deny all connections. This means that unless a rule explicitly permits traffic, any attempt to reach your server will be dropped. If your default policy is currently set to allow, you should change it to deny to ensure security.
You can check the current status of UFW by running the command sudo ufw status verbose. Look for the line that says "Default: deny (incoming)" or similar. If it shows "allow," you need to reset the policies first. Run sudo ufw default deny incoming and sudo ufw default allow outgoing to establish a secure baseline. Always ensure that SSH access is allowed before applying strict incoming deny policies, or you may lock yourself out of the server.
Adding the Allow Rule
The core task is to create a rule that permits TCP traffic on port 1111 specifically from the trusted IP address. Replace YOUR_IP_ADDRESS with the actual IPv4 or IPv6 address of the client machine that needs access. The syntax for UFW is straightforward: specify the protocol, port, and source.
sudo ufw allow from YOUR_IP_ADDRESS to any port 1111 proto tcpThis command tells UFW to accept incoming packets destined for port 1111 if they originate from the specified IP. It does not affect other ports or other source IPs. If your application uses UDP instead of TCP, replace tcp with udp in the command. For applications that use both protocols, you may need to add two separate rules.
Verifying and Deleting Rules
After adding the rule, verify its placement in the firewall chain. Use sudo ufw status numbered to see the rules with their corresponding numbers. This view is crucial because UFW processes rules in order. If you have existing rules that might conflict, such as a general allow-all rule for port 1111, you must delete them first. A general rule would override the specific IP restriction, defeating the purpose of this configuration.
To delete a rule, note its number from the status output and run sudo ufw delete [NUMBER]. For example, if the conflicting rule is number 5, you would run sudo ufw delete 5. Once the conflicting rules are removed, re-add your specific IP rule. This ensures that the most restrictive and precise rule takes precedence.
Testing Connectivity
From the authorized IP address, test the connection using tools like telnet, nc (netcat), or curl. For instance, running nc -zv YOUR_SERVER_IP 1111 should return a success message if the connection is established. From an unauthorized IP, the connection should time out or be refused. This confirms that the firewall is correctly filtering traffic based on source IP.
If you encounter issues, check the UFW logs. Enable logging temporarily with sudo ufw logging on and review /var/log/syslog for dropped packets. This helps diagnose whether the rule is being applied correctly or if another network layer is interfering. For more details on managing firewall exceptions, you might find Securing an Ubuntu Server for Development Purposes helpful for broader context on hardening your system.
Common Pitfalls
A frequent mistake is assuming that adding a new rule removes old ones. UFW does not automatically replace conflicting rules; it adds them sequentially. Therefore, manual cleanup is required. Another pitfall is forgetting to enable UFW itself. If the service is inactive, no rules will be enforced. Ensure it is active with sudo ufw enable.
Additionally, consider the impact of NAT or routing tables if you are behind a complex network setup. In some cases, the source IP seen by the firewall may differ from the original client IP due to proxying or load balancing. In such scenarios, you may need to configure the application or reverse proxy to pass the correct client IP headers, rather than relying solely on UFW source IP matching. For related troubleshooting on connectivity issues, see Ubuntu 22.4.4 LTS: UFW Firewall Allows SSH but Prevents Connection to Another Server.
Frequently Asked Questions
How do I allow multiple IPs on port 1111?
You must add a separate ufw allow rule for each individual IP address. UFW does not support comma-separated lists in a single rule for different sources. Alternatively, you can use CIDR notation if the IPs belong to the same subnet, which allows you to specify a range in one rule.
Can I restrict access to a domain name instead of an IP?
No, UFW operates at the network layer and cannot resolve domain names. You must use the static IP address of the client. If the client has a dynamic IP, consider using a dynamic DNS service and updating the firewall rule manually or via a script when the IP changes.
What happens if I forget my own IP address?
If you lock yourself out, you will need physical or console access to the server to disable UFW temporarily. Run sudo ufw disable and then sudo ufw enable after correcting the rules. Always keep a backup of your ruleset using sudo ufw save before making significant changes.
Does this rule apply to IPv6 addresses?
By default, UFW may handle IPv4 and IPv6 separately depending on your configuration. If your server has IPv6 enabled, you must add a separate rule for the IPv6 address using the same syntax. Check sudo ufw show raw to see if IPv6 rules are being processed.
How do I make these rules persistent across reboots?
UFW rules are stored in configuration files and persist automatically across reboots. Unlike iptables rules added directly without persistence tools, UFW manages its state in /etc/ufw/user.rules, ensuring your configurations remain active after system restarts.