Skip to main content

Firewall: ufw on the server and the Arianet cloud firewall

An Arianet cloud server has two firewall layers, and you can use both together:

Arianet cloud firewallufw
Where it runsOutside the server, in the cloud infrastructureInside the server's operating system
Managed withPanel, CLI, API and TerraformThe ufw command on the server
One firewall for many serversYes, by server id or by labelNo, each server separately
If the OS is broken or misconfiguredKeeps workingMay stop working

Recommended pattern: the cloud firewall only lets in the ports that must be reachable from the internet (for example SSH from your IP only, web from everyone), and ufw repeats that policy on the server and adds finer rules (for example the database only from the private network).

This tutorial targets an Arianet cloud server with Ubuntu 24.04. The ufw part works unchanged on Ubuntu 22.04 and on a VPS.

caution

A cloud server with no cloud firewall accepts all incoming traffic. Put a firewall on every server that has a public IP.

Prerequisites​

  • A cloud server with Ubuntu 24.04 (first SSH login and hardening)
  • Your computer's public IP (for example from curl -4 ifconfig.me); 203.0.113.4 in the examples
  • For the CLI and API parts: the Arianet CLI or an API token with cloud:servers:write

1. Cloud firewall in the panel​

  1. In the cloud menu open Security → Firewalls («امنیت ← فایروال‌ها») and create a firewall.
  2. Add incoming rules, for example:
    • TCP port 22 from 203.0.113.4/32 (your IP only)
    • TCP ports 80 and 443 from 0.0.0.0/0 and ::/0 (everyone)
    • ICMP from everyone, if you want ping to answer
  3. Attach the firewall to the server. The firewalls attached to a server are listed on its Firewall tab.

When creating a new server you can also pick an existing firewall, or create one, in step 5 "Firewall" (Arianet Cloud panel guide).

2. Cloud firewall with the CLI​

arianet cloud firewalls create --name web \
    --rule direction=in,protocol=tcp,port=22,source=203.0.113.4/32 \
    --rule direction=in,protocol=tcp,port=80,source=0.0.0.0/0,source=::/0 \
    --rule direction=in,protocol=tcp,port=443,source=0.0.0.0/0,source=::/0 \
    --rule direction=in,protocol=icmp,source=0.0.0.0/0,source=::/0

Take the firewall id from the output and apply it to servers:

# one or more servers by id
arianet cloud firewalls apply-to <firewall-id> --server 12 --server 13 --wait

# or every server that has the label role=web, now and in the future
arianet cloud firewalls apply-to <firewall-id> --label-selector role=web --wait

With a label selector, servers that later get the role=web label get the firewall automatically, and servers that lose the label lose the firewall too.

  • port is a single port (80) or a range (1000-2000) and only applies to tcp and udp.
  • Protocols: tcp, udp, icmp, esp and gre.
  • A firewall has at most 50 rules.
  • arianet cloud firewalls rules set <id> --rule ... replaces all rules at once; repeat the existing rules in it.

3. Cloud firewall with the API​

BASE=https://api.ariaservice.net/cloud/v1
AUTH="Authorization: Bearer $ARIANET_TOKEN"

curl -s -X POST $BASE/firewalls -H "$AUTH" -H "Content-Type: application/json" -d '{
  "name": "web",
  "rules": [
    {"direction": "in", "protocol": "tcp", "port": "22",  "source_ips": ["203.0.113.4/32"]},
    {"direction": "in", "protocol": "tcp", "port": "80",  "source_ips": ["0.0.0.0/0", "::/0"]},
    {"direction": "in", "protocol": "tcp", "port": "443", "source_ips": ["0.0.0.0/0", "::/0"]}
  ],
  "server_ids": [12]
}'

Apply by label:

curl -s -X POST $BASE/firewalls/<firewall-id>/actions/apply_to_resources -H "$AUTH" \
  -H "Content-Type: application/json" \
  -d '{"apply_to": [{"type": "label_selector", "label_selector": {"selector": "role=web"}}]}'

PUT /firewalls/{id} replaces the name and all rules. Details are in the cloud API and the interactive API reference. You can define the same firewall with the arianet_firewall resource in Terraform.

4. ufw on the server​

ufw is installed on Ubuntu but disabled. Allow SSH first, then enable the firewall:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw --force enable
sudo ufw status verbose

If Nginx is installed you can use sudo ufw allow 'Nginx Full' instead of the two web lines. List the profiles with sudo ufw app list.

Finer rules, for example the database only from the private network:

sudo ufw allow from 10.0.0.0/16 to any port 3306 proto tcp

Delete a rule:

sudo ufw status numbered
sudo ufw delete 4

ufw applies rules to IPv6 as well by default (IPV6=yes in /etc/default/ufw).

Docker and ufw

Ports that Docker publishes with -p or ports: bypass ufw rules, because Docker inserts its own iptables rules ahead of ufw. The cloud firewall runs outside the server and does not have this problem. Details in Install Docker.

Verify​

From your own computer (not from the server), test the ports:

nc -zv -w 3 SERVER_IP 22     # succeeds from your IP
nc -zv -w 3 SERVER_IP 443    # succeeds if a service listens on 443
nc -zv -w 3 SERVER_IP 3306   # should time out

If a port is open in ufw but does not answer from outside, check the cloud firewall rules: arianet cloud firewalls get <firewall-id>.

Common errors​

ProblemFix
SSH dropped after ufw enableLog in through the panel console and run sudo ufw allow OpenSSH or sudo ufw disable.
SSH works from home but not elsewhereThe port 22 rule only accepts your home IP. Add the new IP to the cloud firewall, or log in through the panel console for now.
The service only listens on 127.0.0.1Not a firewall problem; see where the service listens with sudo ss -tlnp.
rules set deleted the existing rulesIt (like PUT /firewalls/{id}) replaces every rule; send the full list or use --rules-file.
invalid_label_selectorCheck the selector format: key=value, key!=value, key or !key, comma-separated.

Next steps​

Create your server​

In Arianet Cloud, apply one firewall to dozens of servers with a single label and pay by the hour. In the Arianet panel, go to Cloud server / Cloud Computing («سرور ابری / Cloud Computing»), create a firewall and pick it when you create a server.