ufw Firewall Basics on Ubuntu

ufw (Uncomplicated Firewall) is Ubuntu’s front end for iptables/nftables, and it’s the simplest way to control which network traffic reaches your VPS. This post covers the basics: checking status, enabling it safely, and allowing or denying specific ports and services.

Before you do anything: the SSH warning

When ufw is enabled, its default policy is to deny all incoming connections unless a rule explicitly allows them. If you enable ufw over an SSH session without first adding a rule to allow SSH, you will lock yourself out immediately, and the only way back in is usually your hosting provider’s console or rescue tooling.

The rule is simple: always allow SSH before you enable ufw. If you haven’t already set up a non-root sudo user to connect with, do that first – see How to Create a New Sudo User in Ubuntu.

Checking ufw’s status

Before changing anything, check whether ufw is already active and what rules exist:

sudo ufw status verbose

On a fresh Ubuntu Server install, ufw is installed but inactive by default.

Allowing SSH, then enabling ufw

Allow SSH first, using either the OpenSSH application profile or the port number directly:

sudo ufw allow OpenSSH

If you’ve moved SSH to a non-standard port, allow that port number instead, for example:

sudo ufw allow 2222/tcp

Now enable ufw:

sudo ufw enable

Before closing your current SSH session, open a second terminal and confirm you can still connect. If you can’t, you still have your original session open to fix the rules – don’t close it until you’ve verified access.

Allowing and denying ports or services

General syntax:

sudo ufw allow /
sudo ufw deny /

You can allow by port number, or by service name where ufw has an application profile registered:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow http
sudo ufw allow https

To see which application profiles are available on your system:

sudo ufw app list

To remove a rule you’ve added, prefix the original command with delete:

sudo ufw delete allow 8080/tcp

Checking your rules

List active rules with numbers, which makes them easier to reference for deletion:

sudo ufw status numbered

You can delete a rule by its number instead of retyping it:

sudo ufw delete 3

Worked example: a typical web server

A common setup for a VPS running a web application is: SSH access, plus HTTP and HTTPS for the web server, and nothing else open.

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

That leaves ports 22, 80, and 443 open, and everything else denied by default – a sensible starting point for most single-purpose VPS deployments. Add further rules only for services you actually need to expose, such as a specific application port or a database port restricted to a known IP.