ufw是Ubuntu系列发行版自带的类似iptables的防火墙管理软件，底层也是基于netfilter的。
官方man手册: http://manpages.ubuntu.com/manpages/trusty/man8/ufw.8.html
Usage:
ufw COMMANDCommands:
enable enables the firewall
disable disables the firewall
default ARG set default policy
logging LEVEL set logging to LEVEL
allow ARGS add allow rule
deny ARGS add deny rule
reject ARGS add reject rule
limit ARGS add limit rule
delete RULE|NUM delete RULE
insert NUM RULE insert RULE at NUM
route RULE add route RULE
route delete RULE|NUM delete route RULE
route insert NUM RULE insert route RULE at NUM
reload reload firewall
reset reset firewall
status show firewall status
status numbered show firewall status as numbered list of RULES
status verbose show verbose firewall status
show ARG show firewall report
version display version informationApplication profile commands:
app list list application profiles
app info PROFILE show information on PROFILE
app update PROFILE update PROFILE
app default ARG set default application policy
一、基本用法
- 启用ufw
~]$ufw enable
- 禁用ufw
~]$ufw diable
- 查看防火墙状态及规则列表
~]$ufw status
- 重置防火墙
~]$ufw reset
- 切换防火墙日志级别
防火墙日志级别从low->full，日志开启后默认就是low级别，记录的日志量最少，内容包括和默认策略不匹配的包(带速率限制)以及匹配了规则的包，full是记录日志内容最多的级别。
~]$ufw logging on|off|LEVEL # level : low medium high full
- 设置防火墙默认策略
~]$ ufw default allow|deny|reject DIRECTION #DIRECTION: incoming outgoing routed
- 添加防火墙规则
如果不指定package的方向(in/out)，则默认为in。
#simple syntax
~]$ufw allow port
~]$ufw allow port/protocol
~]$ufw allow protocol #will check /etc/services for the port and protocol if specifying a service by name.
#fuller syntax
~]$ufw allow proto tcp [from ip/any] to ip/any port 80
~]$ufw deny 80/tcp #禁止其他设备连接到本机的tcp协议的80端口
- 删除防火墙规则
~]$ ufw delete number #以状态码删除规则
~]$ ufw delete allow 80/tcp #指定具体的规则删除
二、应用集成
ufw支持通过配置文件的方式进行应用集成，配置文件位于
/etc/ufw/applications.d，可以使用命令ufw app list列出当前已经集成的应用名称。可以在前面的路径下面添加自定义服务，然后使用ufw allow <name>允许该服务，其中name是应用名。也可以使用完整的语法在最后加上应用名即可。配置示例：
[OpenSSH]
title=Secure shell server, an rshd replacement
description=OpenSSH is a free implementation of the Secure Shell protocol.
ports=22/tcp
