We earn commissions when you shop through the links below. Learn more
How to Set Up a UFW Firewall on Ubuntu
Lock down your Ubuntu server with UFW, the Uncomplicated Firewall: allow SSH first, open only the ports you need, and learn the commands to check, change and remove rules without locking yourself out.
Ubuntu & Debian5-minute setupCopy-ready rules
Quick setup
Turn on UFW safely
Always allow SSH before you enable the firewall. If you enable it first, your current session keeps working, but you won’t be able to log in again.
Changed your SSH port? Allow that port instead, for example sudo ufw allow 2222/tcp.
Allow SSH, then enable
sudo apt install -y ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verboseRules
Common UFW rules
| Rule | What it does |
|---|---|
sudo ufw allow 80,443/tcp | Open a web server (HTTP and HTTPS) |
sudo ufw allow 'Nginx Full' | Same, using Nginx’s app profile |
sudo ufw allow 51820/udp | Open WireGuard VPN |
sudo ufw allow 25565/tcp | Open a Minecraft Java server |
sudo ufw allow from 203.0.113.5 | Allow everything from one IP address |
sudo ufw allow from 203.0.113.5 to any port 22 | Allow SSH from one IP only |
sudo ufw allow 6000:6100/tcp | Open a range of ports |
sudo ufw deny 3306 | Block a port (here MySQL) |
sudo ufw limit OpenSSH | Slow down repeated SSH login attempts |
Managing rules
Check, delete and reset rules
Number your rules to see exactly what’s open, then delete by number. Rules are checked top to bottom, and the first match wins.
Locked down SSH too? Our guide on how to secure SSH pairs perfectly with UFW.
Manage rules
sudo ufw status numbered
sudo ufw delete 3
sudo ufw app list
sudo ufw disable
sudo ufw resetWatch out
Docker can bypass UFW
Docker writes its own firewall rules, so a container started with -p 8080:80 is reachable from the internet even if UFW doesn’t allow port 8080.
The simple fix: publish ports only on localhost and put a reverse proxy such as Nginx in front.
Publish a container on localhost only
docker run -d -p 127.0.0.1:8080:80 nginxExtra layer
UFW and your host’s cloud firewall
Many VPS hosts also offer a free firewall in their dashboard that filters traffic before it reaches your server. Using both is fine: a port must be open in each one for traffic to get through.
Locked yourself out?
Open your provider’s web console from its dashboard, log in, and run sudo ufw allow OpenSSH. The console works even when SSH is blocked.
Need a server?
Need a server to protect?
Every host below gives you an Ubuntu server with full root access, so UFW works exactly as shown.
Simple cloud servers with great docs. Add your SSH key when you create a Droplet.
From about $4/month
View DigitalOcean deals4 GB of RAM and NVMe storage on the entry VPS plan, with an easy control panel.
About $5.19/month on a 24-month term with our extra 20% off
Get 20% off Hostinger VPSYearly KVM VPS deals for about the price of one month elsewhere. Great for learning.
From about $11/year on promo
View RackNerd dealsPrices are approximate. Compare all VPS hosts, including Vultr and ShockHosting.
FAQ
UFW questions, answered
Is UFW enabled by default on Ubuntu?
No. UFW is installed on most Ubuntu images but switched off until you run sudo ufw enable.
Will enabling UFW drop my SSH connection?
Your current session usually stays open, but new connections are blocked unless you allowed SSH first. Always run sudo ufw allow OpenSSH before enabling it.
What is the difference between UFW and iptables?
UFW is a simple front end. It writes iptables or nftables rules for you, so you get the same protection with far easier commands.
Does UFW handle IPv6?
Yes. With IPV6=yes in /etc/default/ufw, which is the default, every rule you add applies to both IPv4 and IPv6.
How do I see UFW logs?
Turn logging on with sudo ufw logging on, then read blocked connections in /var/log/ufw.log or with journalctl -k.
Should I use UFW and fail2ban together?
Yes. UFW controls which ports are open; fail2ban watches logs and temporarily bans IPs that keep failing to log in.