Every building has an entrance. In a normal situation, whoever wants to enter or leave a building must pass through the entrance, whether they like it or not.

This entrance isn't always simply open, either — it may stay open when needed but be closed at certain times.

Some places are even quite particular about who they let in. Think of a restricted security area, or a club on a Friday night.

PC communication works on essentially the same principle. It may look like PCs just communicate freely, but each one comes and goes through an assigned entrance.

If a PC is a building, then the PC's entrance can be called a port (PORT).

Every program is assigned a random entrance, or port, when communicating with a PC. The program performs its designated behavior by going in and out through that port.

If that port is blocked, the program won't be able to operate normally with respect to that computer.

If this program is needed on your PC, you can open the port for it; if not, it's better to close the port to prevent access. Or you could allow the port only for a select few authenticated programs.

This is, quite literally, a concept closely tied to security — through firewall settings, you can open or close a desired port for a desired target.

Let's use ufw on Ubuntu to configure firewall settings exactly the way we want.

In Joseon-era Jeju Island, the concept of locking doors was apparently very weak.

Thanks to the old modes of transportation and the closed nature of being an island, foot traffic was very low, and the identity of each village's residents would have been well established. Outsiders visiting or settling would have been very rare compared to the mainland.

If there's this kind of trust between the surrounding environment and the people, there may be no particular need to be that closed off.

But the internet environment is quite different in nature. As long as you're connected to the internet, anyone has the potential to access your PC. You have no way of knowing who is coming, why, or for what purpose.

In this case, leaving the door wide open however you please is not a good idea.

To protect PCs as much as possible from this kind of problem, firewalls have a closed-by-default configuration. In other words, they start by blocking everything, then open things up as needed.

For security's sake, it's best to keep the firewall as closed as possible, and get into the habit of using a whitelist approach where only the necessary programs are opened.

There's the basic firewall command iptables, but it has the downside of not being very intuitive to use. In comparison, ufw can be handled with much easier and more intuitive commands than iptables.

Given that there's virtually no performance difference from iptables, this is a clear advantage.

ufw is not a default command. Let's install ufw.

BASH
sudo apt-get install ufw

You can install it with the above command.

Commands to manage ufw's status.

BASH
 # Enable ufw
sudo ufw enable

 # Disable ufw
sudo ufw disable

 # Check ufw status
sudo ufw status verbose

After ufw is installed, it's disabled by default to prevent it from affecting the firewall right away.

Enable it with the sudo ufw enable command.

Commands to manage policies applied to ufw.

BASH
 # View policies
sudo ufw show raw

 # Set default policy to allow
sudo ufw default allow

 # Set default policy to deny
sudo ufw default deny

You can allow/block all port communication at once.

BASH
 # Block incoming communication
sudo ufw default deny incoming

 # Allow outgoing communication
sudo ufw default allow outgoing

You've probably heard the saying "block those coming in, don't block those going out." Security works the same way. Be as closed as possible with incoming communication, and as open as possible with outgoing communication.

BASH
 # Allow port 443 (HTTPS)
sudo ufw allow 443

 # Allow TCP on port 443 (HTTPS)
sudo ufw allow 443/tcp

 # Allow UDP on port 443 (HTTPS)
sudo ufw allow 443/udp

 # Allow port 443 (HTTPS)
sudo ufw allow https

The above is a collection of commands to allow HTTPS port 443.

ufw can manage ports using well-known service names. HTTP (80), HTTPS (443), FTP (21), SSH (22), and so on all fall under this.

Besides allow, you can also deny to reject communication, or use delete to remove that policy entirely.

Once a policy is deleted, it falls back to the default policy configured in ufw.

BASH
 # Allow communication from IP 192.168.0.5
sudo ufw allow from 192.168.0.5

 # Allow communication from the IP range 192.168.0.5 ~ 200
sudo ufw allow from 192.168.0.5/200

The above commands let you manage communication from a specific IP or IP range.

BASH
 # Allow port 443 from IP 192.168.0.5
sudo ufw allow from 192.168.0.5 to any port 443

 # Allow TCP on port 443 from IP 192.168.0.100
sudo ufw allow from 192.168.0.5 to any port 443 proto tcp

You can also allow/block only a specific port for a specific IP.

BASH
sudo ufw status numbered

Shows the currently applied policies along with their index numbers.

You can use that number to modify or delete a policy.

BASH
 # Change policy 1 to a policy blocking port 443
sudo ufw insert 1 deny 443

 # Change policy 2 to a policy allowing communication from IP 192.168.0.5
sudo ufw insert 2 allow from 192.168.0.5

BASH
 # Delete policy 1
sudo ufw delete 1

Considering the role and importance a server plays in a service, server security is directly tied to the stability of the service.

For that reason, it's desirable for server security to be built up as thoroughly and meticulously as possible.

Since data communication is the foundation of any service — whether it's a program or the web — controlling that communication well is important.

Configure your security policy so that only truly necessary communication is permitted and managed, keeping the server's security at its best at all times.