How to Set Up a UFW Firewall on Ubuntu

A firewall decides which network ports the world can reach. On Ubuntu, UFW (Uncomplicated Firewall) is the friendliest way to manage this — it's a clean front end to iptables/nftables. This guide gets you from a wide-open server to a locked-down one that exposes only what you need.

Install and check UFW

UFW ships on most Ubuntu images. If it's missing:

sudo apt update
sudo apt install ufw -y

Check the current state before changing anything:

sudo ufw status verbose

Set default policies first

The safe pattern is deny everything inbound, allow everything outbound, then open only the ports you need:

sudo ufw default deny incoming
sudo ufw default allow outgoing

Critical: allow SSH before you enable

If you enable UFW without an SSH rule, you'll be disconnected instantly and locked out. Always allow SSH first:

sudo ufw allow OpenSSH

That uses UFW's app profile for port 22. If you moved SSH to a custom port (see harden SSH):

sudo ufw allow 2222/tcp

Enable the firewall

Now turn it on. UFW warns that this may disrupt existing connections — since you allowed SSH, your session survives:

sudo ufw enable

{{SCREENSHOT}}

Open the ports your services need

Web server? Allow HTTP and HTTPS:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

UFW also understands named apps. List them with sudo ufw app list, then sudo ufw allow 'Nginx Full'. For a game server, open only the specific game ports — our firewall for a game server guide covers common ones.

Rate-limit SSH

UFW can throttle repeated connections to a port, which blunts brute-force attempts. Instead of allow, use limit:

sudo ufw limit OpenSSH

This blocks an IP that makes 6+ connections in 30 seconds. Combine it with fail2ban for stronger coverage.

Restrict a port to a specific IP

To expose a database or admin port only to your office IP, not the world:

sudo ufw allow from 203.0.113.7 to any port 3306 proto tcp

This is far safer than opening MySQL to everyone — see secure a MySQL database.

Manage and delete rules

List rules with numbers, then delete by number:

sudo ufw status numbered
sudo ufw delete 3

To reset everything and start over:

sudo ufw reset

Verify from outside

Rules can look right but behave wrong. Test from another machine, or use an online port checker to confirm only your intended ports respond. A closed port should time out or refuse the connection.

The Docker gotcha every UFW user must know

Here's a trap that catches thousands of people: Docker bypasses UFW. When you publish a container port with -p 8080:80, Docker writes its own iptables rules ahead of UFW's, so the port is exposed to the internet even though ufw status shows it as blocked. You think you're protected; you aren't.

The safe habit is to bind published ports to localhost whenever a container should only be reachable through a reverse proxy:

docker run -p 127.0.0.1:8080:80 myimage

That way the port is only reachable locally, and UFW's rules for your public-facing proxy still apply. If you need UFW and Docker to cooperate more fully, the community project ufw-docker adds rules that make UFW aware of Docker's published ports. Whatever you do, don't assume ufw status tells the whole story on a Docker host — verify with an external port scan. There's more on this in secure Docker containers.

Logging and reviewing blocked traffic

UFW can log what it blocks, which is useful for spotting scans and misconfigurations:

sudo ufw logging on

Blocked packets then appear in the system journal and /var/log/ufw.log, tagged [UFW BLOCK]. Review them with:

sudo grep 'UFW BLOCK' /var/log/ufw.log | tail

Don't leave logging on high permanently on a busy server — it's noisy and eats disk. The default low level logs blocked traffic without drowning you, and pairs well with the log-reading habits in the journalctl guide. A quick weekly glance at blocked traffic often reveals a service you forgot to firewall, or a scanner worth banning outright with fail2ban.

FAQ

Does UFW replace iptables?

UFW is a friendlier front end that configures the same underlying netfilter engine. You get iptables-grade filtering without hand-writing chains.

Will enabling UFW drop my SSH session?

Not if you allow SSH first. Existing connections are generally kept, but always add the SSH rule before ufw enable to be safe.

UFW vs nftables — which should I use?

For most single-server setups UFW is plenty. If you need complex rule sets, learn nftables directly. UFW covers 95% of VPS needs.

How do I temporarily disable the firewall?

sudo ufw disable turns it off; sudo ufw enable turns it back on with your rules intact. Avoid leaving it off on a public server.

The complete setup in one place

Here's the whole safe sequence for a typical web server, in order — the ordering matters, because allowing SSH before enabling is what keeps you connected:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw limit OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

That's a server exposing only SSH (rate-limited), HTTP, and HTTPS, with everything else denied. Adapt the middle lines to your services — a database stays closed to the internet, a game server opens only its specific ports. Two habits keep a firewall trustworthy over time: review sudo ufw status numbered whenever you add a service so nothing lingers open by accident, and verify from an external machine that only your intended ports actually respond. A firewall you never audit slowly drifts open as you add things; a quick monthly check keeps it honest.

A default-deny firewall is one of the highest-value ten-minute jobs on a new server. Want full root access to configure it your way? See Nxeon VPS hosting, our security page, and the wider securing your first Linux VPS checklist.