Skip to main content
To set up UFW on Ubuntu, first allow SSH with sudo ufw allow OpenSSH, set the defaults with sudo ufw default deny incoming and sudo ufw default allow outgoing, then turn the firewall on with sudo ufw enable. Open each extra port your server needs, for example sudo ufw allow 443/tcp, and check the result with sudo ufw status verbose. UFW (Uncomplicated Firewall) is a simple front end for the Linux packet filter. A firewall decides which network connections reach your server. UFW is installed on Ubuntu but turned off by default. On Debian you install it first.

​
Before you start

  • You need root or a sudo user. Root users can leave out sudo.
  • Know your SSH port. It is 22 unless you changed it. Check with sudo ss -tlpn | grep ssh.
  • Have a way back in if you lock yourself out: the VNC console on a VPS, or open a ticket on a dedicated server.
  • On AlmaLinux or Rocky Linux use firewalld instead. Do not run UFW and firewalld at the same time.
If you run sudo ufw enable before you allow SSH, UFW blocks your SSH connection and you lose access. Always allow your SSH port first.

​
How to set up UFW on Ubuntu

1

Install UFW (Debian only)

Ubuntu already has UFW. On Debian, install it:
2

Set the default policies

Block all incoming connections and allow all outgoing ones:
3

Allow SSH

OpenSSH is an application profile for port 22/tcp. If you moved SSH to another port, allow that port instead, for example sudo ufw allow 2222/tcp.
4

Allow your other services

Add a rule for each service, for example a web server:
5

Turn on the firewall

Type y when UFW warns that the command may disrupt SSH connections. UFW now starts automatically at boot.
6

Test SSH from a second session

Open a new terminal and log in. Keep the first session open until this works.

​
How to allow a port in UFW

ufw limit denies an IP address that opens 6 or more connections within 30 seconds. It is a light alternative to Fail2Ban. To see the application profiles installed by your packages (for example Nginx Full or Apache Full), run:

​
How to delete a UFW rule

1

List rules with numbers

2

Delete by number

Numbers shift after each delete, so list the rules again before you delete another one.
You can also delete a rule by repeating it after delete, for example sudo ufw delete allow 80/tcp.

​
How to check it worked

Example output:
UFW adds IPv6 rules automatically because IPV6=yes is set in /etc/default/ufw. To test a port from outside, see check if a port is open from outside.

​
Does Docker bypass UFW?

Yes. When you publish a container port (for example -p 8080:80), Docker adds its own packet-filter rules, and that traffic does not pass through your UFW rules (Docker documentation). To keep a container private, publish it on localhost only, for example -p 127.0.0.1:8080:80, and put a reverse proxy in front of it.

​
How to turn UFW off or reset it

sudo ufw reset turns UFW off and deletes all your rules. Use it only from the VNC console or when you plan to re-add SSH straight away.

​
Frequently asked questions

​
Why can I not connect after enabling UFW?

The port is probably not allowed, or the service listens on a different port. Run sudo ufw status and sudo ss -tulpn and compare them. If SSH is blocked, use the VNC console and see fix being locked out after a firewall change.

​
Do UFW rules survive a reboot?

Yes. After sudo ufw enable, UFW and its rules load at every boot.

​
Does UFW protect against DDoS attacks?

No. UFW runs on your server, so the traffic has already reached it. Network-level filtering happens before your server; see apply DDoS filters.

​
Where are UFW logs?

On Ubuntu, blocked connections appear in /var/log/ufw.log with the prefix [UFW BLOCK]. Turn logging on with sudo ufw logging on. On Debian 12 and 13 without rsyslog, use sudo journalctl -k | grep UFW.

VPS and dedicated server guides

Every guide in this section.

Set up firewalld

Firewall for AlmaLinux and Rocky.

nftables and iptables

Write rules without a front end.

Check open ports

See what is listening.

Locked out after a firewall change

Get back into your server.

Firewall panel

Filter traffic before it reaches your server.
Checked against the official Ubuntu Server firewall documentation on 4 November 2026; every rule on this page was tested with ufw --dry-run on Ubuntu 24.04 LTS (ufw 0.36.2). Commands can differ on other distributions or releases.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026