Delete, insert and reorder UFW rules safely

Firewall rules pile up. Old test ports stay open, IP addresses change and rules end up in the wrong order. This guide shows how to remove UFW rules cleanly, put new rules exactly where they belong and start again from a blank set without losing your SSH connection.

Before you start

• A Linux VPS running Ubuntu 22.04, Ubuntu 24.04 or Debian 12 with UFW active. If you are new to UFW, read Set up the UFW firewall on Ubuntu and Debian first.
• A sudo user connected over SSH.
• Your SSH port (22 unless you changed it).

List rules with numbers

UFW checks rules from the top down and stops at the first match. To see that order with a number for each rule, run:

sudo ufw status numbered

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 2] 80/tcp                     ALLOW IN    Anywhere
[ 3] 8080/tcp                   ALLOW IN    Anywhere
[ 4] 22/tcp (v6)                ALLOW IN    Anywhere (v6)
[ 5] 80/tcp (v6)                ALLOW IN    Anywhere (v6)
[ 6] 8080/tcp (v6)              ALLOW IN    Anywhere (v6)

IPv4 rules come first, then the IPv6 copies marked (v6). Each copy has its own number.

Delete a rule by number

To remove rule 3:

sudo ufw delete 3

UFW shows the rule and asks you to confirm with y. Two things to know:

• Numbers shift after every delete. After removing rule 3, the old rule 4 becomes rule 3. Run sudo ufw status numbered again before each delete. Never run a series of delete commands from one old listing.
• Deleting by number removes one copy only. In the example above, deleting rule 3 leaves the IPv6 rule for 8080 behind. Delete the (v6) line too, after listing again.

Delete a rule by its text

You can also delete by repeating the rule with delete in front of it:

sudo ufw delete allow 8080/tcp

This removes both the IPv4 and IPv6 copies in one step, and the result does not depend on numbering. The text must match the original rule. For example, a rule added as sudo ufw allow from 203.0.113.10 to any port 22 proto tcp must be deleted with exactly the same words after delete allow.

To delete an application profile rule, quote the name:

sudo ufw delete allow 'Nginx HTTP'

Insert a rule at a position

New rules go to the end of the list. That is a problem for deny rules: if an ALLOW 22/tcp Anywhere rule sits above them, the allow matches first and the deny never runs.

Use insert to place a rule at a set position:

sudo ufw insert 1 deny from 198.51.100.20

The new rule becomes number 1 and everything else moves down. insert works within one address family. If you try to insert an IPv4 rule at a position that holds an IPv6 rule, UFW returns an "Invalid position" error. Pick a number inside the IPv4 block instead.

Newer UFW versions also offer prepend, which puts the rule at the top of the matching IPv4 or IPv6 list:

sudo ufw prepend deny from 198.51.100.20

If your version does not know prepend, use insert 1.

Reorder rules

UFW has no "move" command. To move a rule, insert a copy where you want it, check the listing, then delete the old copy:

sudo ufw insert 1 allow from 203.0.113.10 to any port 22 proto tcp comment 'SSH from office'
sudo ufw status numbered
sudo ufw delete 5

Use the second listing to find the old rule's new number, and replace 5 with that number. Adding first and deleting second means there is never a moment when the rule is missing.

Reset UFW without locking yourself out

ufw reset turns the firewall off and returns all rules to the installed defaults. UFW saves a backup of the old rule files in /etc/ufw/ with a date and time in the file name.

sudo ufw reset

Because reset also disables UFW, your SSH session survives the reset itself. The danger comes next: if you enable UFW again before adding an SSH rule, you are locked out. Rebuild in this order:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw enable

Then add your other rules back one at a time.

Check it works

• Run sudo ufw status numbered and confirm the deleted rules are gone in both IPv4 and (v6) form.
• Open a new SSH session from your computer before you close the current one. If it connects, your SSH rule is intact.
• From another machine, test a port you closed with nc -vz 203.0.113.10 8080. It should now time out or be refused.

Troubleshooting

• "Could not delete non-existent rule": the text does not match the original rule. Use sudo ufw status numbered and delete by number instead.
• Deleted the wrong rule: add it again straight away with the same ufw allow command. If it was SSH and you lost access, use your VPS provider's browser console. See Locked out by your firewall? How to get back in.
• IPv6 copy still listed: you deleted by number. List again and delete the (v6) line too.
• Deny rule has no effect: it sits below a matching allow rule. Move it up with insert.

Next steps

• Learn the full allow syntax: Open ports with UFW: single ports, ranges and trusted IPs.
• Use deny rules well: Block an IP address or subnet with UFW.
• Make risky changes undo themselves: Test firewall changes safely with an automatic rollback.