UFW Host Firewall with SSH and Service Allowlists

Install UFW and apply a host firewall policy with restricted SSH, HTTP and HTTPS, and optional source-specific TCP rules.

↓ Download↓ 0 downloads

Summary

Category: Jet Templates
Tags: System
Authors: Cetmix OÜ
License: AGPL-3
Version: 1.0.0
Call sign: jet_template_ufw
Website: cetmix.com/contact

This snippet imports a UFW Jet Template for an apt-based Linux host. It allows one firewall Jet per server and requires Tower Core, which is included and handles SSH checks, host key capture and package updates. Installing the UFW template installs the ufw package. Build renders a firewall configuration script for the host.

Configure and enable

Import the YAML and install the template. Set ssh_allow_list to a comma-separated list of source addresses that must retain access to TCP port 22, including the address Tower connects from. The script exits if this list is empty.
Optionally set ufw_allow_list to comma-separated IP:PORT entries for additional inbound TCP traffic, such as access from Prometheus to a host exporter.
Create the Jet and run Start to apply the policy. Start resets existing UFW rules, sets default deny for incoming traffic and default allow for outgoing traffic, and allows SSH only from the listed sources. It opens TCP 80 and 443, adds optional inbound rules and explicit outgoing SMTP, IMAP and POP3 rules, enables UFW and sets low-level logging.

Operate

Check the Start plan output for the resulting policy and use UFW Log to inspect /var/log/ufw.log. Stop disables UFW. Remove, available from Stopped, cleans up the Jet's deployment files. Confirm the SSH source list and required inbound rules before starting because the reset replaces the host's existing UFW policy.

These Terms and Conditions (“Terms”) govern your access to and use of YAML configuration files (“Packages”, “YAML Snippets”, or “Snippets”) made available via the Cetmix Tower platform, operated by Cetmix OÜ, Ranna 6, Haademeeste, Voiste, 86501, Estonia (“Cetmix”, “we”, “our”, or “us”).

By downloading, installing, or otherwise using any YAML Snippets from the Cetmix Tower platform, you agree to be bound by these Terms.

1. Use of Packages

1.1. The YAML Snippets are provided either by Cetmix or third-party authors (“Authors”).

1.2. You are solely responsible for verifying the functionality, safety, and suitability of any YAML Snippet before using it in a production environment.

1.3. You may use the Snippets only in accordance with their respective licenses, which may be open-source or commercial.

2. Author Responsibility

2.1. Authors are solely responsible for the content, accuracy, functionality, and compliance of the YAML Snippets they publish.

2.2. Cetmix does not review or verify the correctness, security, or compliance of third-party Snippets.

2.3. If you are an Author, you represent and warrant that your submitted YAML Snippet:

Does not infringe on any third-party rights;
Complies with applicable laws and regulations;
Does not contain harmful, malicious, or misleading code or behavior.

3. Limitation of Liability

3.1. Cetmix provides access to the YAML Snippets “as is” and “as available,” without warranties of any kind, either express or implied.

3.2. Cetmix expressly disclaims all liability for any damages resulting from:

Use or inability to use a YAML Snippet;
Errors or omissions in the Snippets;
Actions taken in reliance on any YAML Snippet;
Misuse, misconfiguration, or system failure caused by a Snippet.

3.3. In no event shall Cetmix OÜ be liable for any indirect, incidental, special, punitive, or consequential damages, including but not limited to loss of data, profits, or service availability.

4. Security and Compliance

4.1. Cetmix does not guarantee that any Snippet is secure or free from vulnerabilities. You must review and test all Snippets before deploying them in sensitive or production environments.

4.2. Compliance with security, privacy, and regulatory requirements is your responsibility when using any Snippet.

5. Intellectual Property

5.1. Ownership of each YAML Snippet remains with its respective Author.

5.2. You must respect all license terms specified for each Snippet. Unauthorized reproduction, distribution, or sublicensing may result in legal consequences.

6. Modifications and Termination

6.1. Cetmix may modify or remove any YAML Snippet at any time without notice.

6.2. These Terms may also be updated periodically. Continued use of the platform constitutes acceptance of the revised Terms.

7. Governing Law and Jurisdiction

These Terms shall be governed by the laws of the Republic of Estonia. Any disputes arising under or in connection with these Terms shall be subject to the exclusive jurisdiction of the courts of Estonia.

8. Contact

For questions or concerns regarding these Terms or specific YAML Snippets, please contact us