UFW Firewall Hardening: Advanced Rate Limiting & Default-Deny Security Blueprint

1. Establishing Default-Deny Baseline Policies

Unused open ports are primary targets for automated port scanners. A strict firewall baseline mandates dropping all incoming traffic by default unless explicitly allowed.

When default-deny incoming is enforced, Linux drops all TCP SYN requests and UDP packets to closed ports without sending ICMP unreachable responses, preventing port scanning reconnaissance.

Execute the following baseline initialization sequence on production Debian and Ubuntu instances:

# Reset UFW to clean state
ufw --force reset

# Set default traffic policies
ufw default deny incoming
ufw default allow outgoing

# Allow SSH on custom port with rate limiting
ufw limit 22/tcp comment 'SSH Rate Limited'

# Enable UFW logging
ufw logging low
ufw --force enable

2. Advanced SSH Rate Limiting & Brute-Force Prevention

Automated bots scan IPv4 CIDR blocks continuously for open port 22. Standard ufw allow 22/tcp leaves the SSH port vulnerable to sustained password guessing and handshake attacks.

The ufw limit directive leverages iptables recent module to track connection attempts per IP address. If an IP address attempts 6 or more connections within a 30-second window, UFW automatically drops packets from that IP address.

For maximum security, combine ufw limit with custom SSH listening ports to eliminate 99% of automated scanner noise.

# Restrict custom SSH port with rate limiting
ufw limit 2222/tcp comment 'Custom SSH Port Limited'

# Inspect UFW active rules with rule numbers
ufw status numbered

3. Defining Custom Application Profiles

Instead of specifying raw port numbers directly in shell scripts, define structured application profiles in /etc/ufw/applications.d/. Profiles standardize firewall configurations across fleet management tooling.

Application profiles specify the title, description, and exact TCP/UDP ports required by a service.

Reload UFW application profiles and verify profile syntax using ufw app list.

# Create /etc/ufw/applications.d/custom-web.ini
[CustomWebserver]
title=Custom Production Web Server
description=Allows HTTP and HTTPS traffic on standard web ports
ports=80,443/tcp

# Apply application profile
ufw allow CustomWebserver

4. Interface Isolation & Subnet Access Control

Multi-homed cloud instances connected to public internet interfaces and private VPC networks must restrict management access strictly to private interfaces.

Configuring interface-specific rules prevents administrative ports (e.g., Redis on 6379, Postgres on 5432) from exposing bindings to public IPv4 addresses.

Use in on directives to bind rules to specific network interfaces like eth1 or wireguard wg0.

# Allow PostgreSQL strictly on private VPC interface eth1
ufw allow in on eth1 to any port 5432 proto tcp comment 'Private DB Access'

# Allow WireGuard VPN traffic on public interface eth0
ufw allow in on eth0 to any port 51820 proto udp comment 'WireGuard Public VPN'

5. Logging Calibration & Logrotate Management

Uncalibrated firewall logging can fill server root disks rapidly during heavy DDoS attacks. UFW supports five logging levels: off, low, medium, high, and full.

Logging level low records all blocked packets that violate default policy, plus matching logged rules. Logs are saved to /var/log/ufw.log.

Ensure logrotate compresses UFW log files daily to preserve disk headroom.

# Set optimal production logging level
ufw logging low

# Tail live UFW blocked packets
tail -f /var/log/ufw.log | grep '[UFW BLOCK]'

6. Verification & Security Audit Checklist

Verify UFW active status, rule numbers, and default policies using verbose status outputs.

Test firewall rule enforcement from an external client using nmap port scans.

# Verify UFW status and rules
ufw status verbose

# External port audit with nmap
nmap -sS -p 22,80,443,5432 

Written by Zyekh Abdul Qadir Jailani

Digital Forensics & Incident Response (DFIR) Specialist & Security Researcher specializing in Linux kernel hardening, threat hunting, and system security research.

LinkedIn • GitHub • Discord • Email • PGP Key