Ubuntu UFW (Uncomplicated Firewall) Rules & Script Generator

#!/usr/bin/env bash
# ==============================================================================
# Ubuntu UFW (Uncomplicated Firewall) Production Provisioning Script
# Generated securely via ToolsAA (https://toolsaa.com/tools/ufw-rules-generator)
# 100% Client-Side Private • Zero-Knowledge Architecture
# ==============================================================================
set -euo pipefail

# Ensure script is executed with root superuser privileges
if [[ $EUID -ne 0 ]]; then
  echo -e "\033[0;31m[ERROR]\033[0m This script must be run as root: sudo bash $0" >&2
  exit 1
fi

# Step 1: Ensure UFW package is installed and active
if ! command -v ufw &>/dev/null; then
  echo ">>> [INSTALL] UFW not detected. Installing via apt-get..."
  export DEBIAN_FRONTEND=noninteractive
  apt-get update -y && apt-get install -y ufw iptables iptables-persistent
fi

# Step 2: Create atomic timestamped backup of current firewall configuration
BACKUP_DIR="/etc/ufw/backups/ufw_backup_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$BACKUP_DIR"
if [[ -d /etc/ufw ]]; then
  cp -r /etc/ufw/*.rules /etc/default/ufw "$BACKUP_DIR/" 2>/dev/null || true
  echo ">>> [BACKUP] Saved existing configuration to $BACKUP_DIR"
fi

# Step 3: Configure IPv6 policy in /etc/default/ufw
if [[ -f /etc/default/ufw ]]; then
  sed -i 's/^IPV6=.*/IPV6=yes/' /etc/default/ufw
  sed -i 's/^DEFAULT_FORWARD_POLICY=.*/DEFAULT_FORWARD_POLICY="DROP"/' /etc/default/ufw
fi

# Step 4: Reset UFW to a clean baseline (force non-interactive)
echo ">>> [RESET] Resetting UFW to pristine baseline..."
ufw --force reset

# Step 5: Set Global Default Policies
ufw default deny incoming
ufw default allow outgoing
ufw default deny routed
ufw logging low

# Step 6: Loopback (lo) Interface Whitelist
ufw allow in on lo comment 'Allow local loopback incoming'
ufw allow out on lo comment 'Allow local loopback outgoing'

# Step 7: Apply User Defined Firewall Rules
ufw limit 22/tcp comment 'Rate limited SSH access against brute force'
ufw allow 80/tcp comment 'Public HTTP web traffic'
ufw allow 443/tcp comment 'Public HTTPS SSL/TLS traffic'
ufw allow in on eth1 from 10.0.0.0/16 to any port 3306 proto tcp comment 'Internal VPC MySQL cluster replication'
ufw allow in on lo from 127.0.0.1 to any port 6379 proto tcp comment 'Local Redis key-value cache'

# Step 9: Enable Firewall & Verify State
echo ">>> [ENABLE] Activating UFW firewall rules..."
ufw --force enable

echo -e "\n\033[0;32m[SUCCESS]\033[0m UFW Firewall has been configured and activated!"
echo ">>> Active Firewall Status:"
ufw status verbose
echo ""
echo ">>> Numbered Rule List (use: sudo ufw delete <number> to modify):"
ufw status numbered