Ubuntu UFW Firewall Setup and Basic Rules

In short: UFW (Uncomplicated Firewall) is the simple front end to the Linux firewall on Ubuntu and Debian. The order matters: allow SSH first, then only the services you run, then enable the firewall, and test from a second session so you never lock yourself out.

Check the current state

sudo ufw status verbose

On a fresh server UFW is usually installed but inactive. Before adding rules, see which services are listening: ss -tulpn lists the open ports.

Allow SSH first

If SSH runs on the standard port, use the application profile:

sudo ufw allow OpenSSH

If you moved SSH to another port, allow that port over TCP instead, for example sudo ufw allow 2222/tcp. After adding the rule, open a second SSH connection to confirm it works before you go on.

Web server ports

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Add other services the same way only if the server really offers them: 25/465/587 and 993 for a mail server, 3306 for MySQL only if remote access is required (prefer an SSH tunnel).

Enable UFW

sudo ufw enable
sudo ufw status numbered

The default policy denies all incoming traffic and allows outgoing. The numbered list shows the order and scope of each rule.

Allow a specific IP address only

Instead of opening management ports to the world, restrict them to a fixed admin address:

sudo ufw allow proto tcp from 203.0.113.10 to any port 22

Replace the example with your own address. If your connection has a dynamic IP, remember it can change and keep a fallback such as the FiberVM console.

Delete a rule

sudo ufw status numbered
sudo ufw delete RULE_NUMBER

Check the status again after deleting. Be careful when changing default policies or the remote-access rules.

Logging and maintenance

sudo ufw logging on
sudo ufw status verbose

Logs go to /var/log/ufw.log; review them for repeated blocked attempts and combine the firewall with hardened SSH and Fail2Ban.

Rate limiting

sudo ufw limit OpenSSH allows SSH but blocks an address that opens more than six connections in thirty seconds, a cheap brake on brute-force attempts.

A firewall alone does not secure a server. Use it together with system updates, strong authentication, least privilege, careful service configuration and regular log review; the first-day checklist puts the pieces in order.