UFW (Uncomplicated Firewall) is the friendly front end to the Linux firewall on Ubuntu and Debian. A few commands give a VPS a deny-by-default firewall that only opens the ports you need. This UFW firewall setup takes about five minutes.
Before you start
- Root or sudo access to Ubuntu or Debian (UFW is preinstalled on Ubuntu; on Debian run
apt install ufw). - Know your SSH port (
ss -ltnp | grep ssh). - Provider console access in case of a mistake.
- On cPanel/WHM servers use CSF instead, and on AlmaLinux/Rocky use firewalld; do not run two firewall managers at once.
Set default policies
ufw default deny incoming
ufw default allow outgoingIncoming connections are blocked unless a rule allows them; the server can still reach the internet for updates.
Allow SSH before enabling
Danger: enabling UFW without an SSH rule cuts off your session. Always add SSH first.
ufw allow OpenSSHIf SSH runs on a custom port: ufw allow 2222/tcp. Better still, allow SSH only from your own IP:
ufw allow from 198.51.100.25 to any port 22 proto tcpAllow web traffic
ufw allow 80/tcp
ufw allow 443/tcpOr use an application profile such as ufw allow 'Nginx Full'; list profiles with ufw app list. Add ufw allow 443/udp if you serve HTTP/3.
Enable and check
ufw enableufw status verboseOpen a new SSH session to confirm you can still connect before closing the current one.
More rule examples
| Goal | Command |
|---|---|
| Allow MySQL only from an app server | ufw allow from 10.0.0.5 to any port 3306 proto tcp |
| Allow a port range | ufw allow 30000:30100/tcp |
| Block an IP | ufw insert 1 deny from 203.0.113.50 |
| Rate-limit SSH (6 tries/30s) | ufw limit 22/tcp |
| Allow on one interface | ufw allow in on wg0 |
insert 1 puts the deny rule first; UFW processes rules in order and the first match wins.
Delete or change rules
ufw status numberedufw delete 3Disable the firewall entirely with ufw disable, or start over with ufw reset.
Docker and UFW
Docker writes its own iptables rules, so ports published with -p 8080:80 are reachable from the internet even if UFW denies them. Safer options:
- Publish ports on localhost only:
127.0.0.1:8080:80, and expose services through a reverse proxy. - Or add rules to the
DOCKER-USERchain (through/etc/ufw/after.rules) to filter container traffic.
Logging
ufw logging low records blocked packets in /var/log/ufw.log (or the journal). Check it when a legitimate connection fails.
Troubleshooting
- Locked out after enabling: log in through the provider console and run
ufw allow OpenSSHorufw disable. - Port still unreachable after allowing it: the service may listen only on 127.0.0.1, or a provider-level firewall blocks it.
- IPv6 not filtered: make sure
IPV6=yesin/etc/default/ufw, then reload.
UFW FAQ
Is UFW secure enough for a production server?
Yes. It manages the same kernel netfilter firewall as hand-written rules; UFW just makes it easier.
UFW or firewalld?
Use UFW on Ubuntu/Debian and firewalld on AlmaLinux/Rocky; each is the default for its family.
Do I need UFW if my provider has a firewall?
A host firewall adds a second layer and protects you even if the provider rules change. Using both is good practice.