> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Set Up a UFW Firewall on Ubuntu and Debian

> UFW firewall setup on Ubuntu: allow SSH with sudo ufw allow OpenSSH, set default deny incoming, run sudo ufw enable, then open only the ports your VPS needs.

To set up UFW on Ubuntu, first allow SSH with `sudo ufw allow OpenSSH`, set the defaults with `sudo ufw default deny incoming` and `sudo ufw default allow outgoing`, then turn the firewall on with `sudo ufw enable`. Open each extra port your server needs, for example `sudo ufw allow 443/tcp`, and check the result with `sudo ufw status verbose`.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner | 10 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13 | Root or sudo access |

UFW (Uncomplicated Firewall) is a simple front end for the Linux packet filter. A firewall decides which network connections reach your server. UFW is installed on Ubuntu but turned off by default. On Debian you install it first.

## Before you start

* You need root or a sudo user. Root users can leave out `sudo`.
* Know your SSH port. It is `22` unless you changed it. Check with `sudo ss -tlpn | grep ssh`.
* Have a way back in if you lock yourself out: the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) on a VPS, or [open a ticket](https://freakhosting.com/clientarea/submitticket.php) on a dedicated server.
* On AlmaLinux or Rocky Linux use [firewalld](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-firewalld.md) instead. Do not run UFW and firewalld at the same time.

> [!WARNING]
>
> If you run `sudo ufw enable` before you allow SSH, UFW blocks your SSH connection and you lose access. Always allow your SSH port first.

## How to set up UFW on Ubuntu

**1. Install UFW (Debian only)**

Ubuntu already has UFW. On Debian, install it:

```bash theme={null}
sudo apt update
sudo apt install ufw
```

**2. Set the default policies**

Block all incoming connections and allow all outgoing ones:

```bash theme={null}
sudo ufw default deny incoming
sudo ufw default allow outgoing
```

**3. Allow SSH**

```bash theme={null}
sudo ufw allow OpenSSH
```

`OpenSSH` is an application profile for port 22/tcp. If you moved SSH to another port, allow that port instead, for example `sudo ufw allow 2222/tcp`.

**4. Allow your other services**

Add a rule for each service, for example a web server:

```bash theme={null}
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
```

**5. Turn on the firewall**

```bash theme={null}
sudo ufw enable
```

Type `y` when UFW warns that the command may disrupt SSH connections. UFW now starts automatically at boot.

**6. Test SSH from a second session**

Open a new terminal and log in. Keep the first session open until this works.

## How to allow a port in UFW

| Task | Command |
| - | - |
| One TCP port | `sudo ufw allow 443/tcp` |
| One UDP port | `sudo ufw allow 51820/udp` |
| TCP and UDP on one port | `sudo ufw allow 25565` |
| Several ports | `sudo ufw allow 80,443/tcp` |
| A port range (protocol required) | `sudo ufw allow 27015:27020/udp` |
| One IP to one port | `sudo ufw allow from 203.0.113.10 to any port 3306 proto tcp` |
| Block an IP completely | `sudo ufw deny from 198.51.100.7` |
| Rate-limit SSH | `sudo ufw limit 22/tcp` |

`ufw limit` denies an IP address that opens 6 or more connections within 30 seconds. It is a light alternative to [Fail2Ban](https://help.freakhosting.com/portals/other/how-to-set-up-fail2ban-for-ssh-on-ubuntu.md).

To see the application profiles installed by your packages (for example `Nginx Full` or `Apache Full`), run:

```bash theme={null}
sudo ufw app list
```

## How to delete a UFW rule

**1. List rules with numbers**

```bash theme={null}
sudo ufw status numbered
```

**2. Delete by number**

```bash theme={null}
sudo ufw delete 3
```

Numbers shift after each delete, so list the rules again before you delete another one.

You can also delete a rule by repeating it after `delete`, for example `sudo ufw delete allow 80/tcp`.

## How to check it worked

```bash theme={null}
sudo ufw status verbose
```

Example output:

```text theme={null}
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp (OpenSSH)           ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere
22/tcp (OpenSSH (v6))      ALLOW IN    Anywhere (v6)
80/tcp (v6)                ALLOW IN    Anywhere (v6)
443/tcp (v6)               ALLOW IN    Anywhere (v6)
```

UFW adds IPv6 rules automatically because `IPV6=yes` is set in `/etc/default/ufw`. To test a port from outside, see [check if a port is open from outside](https://help.freakhosting.com/portals/other/how-to-check-if-a-port-is-open-from-outside.md).

## Does Docker bypass UFW?

Yes. When you publish a container port (for example `-p 8080:80`), Docker adds its own packet-filter rules, and that traffic does not pass through your UFW rules ([Docker documentation](https://docs.docker.com/engine/network/packet-filtering-firewalls/)). To keep a container private, publish it on localhost only, for example `-p 127.0.0.1:8080:80`, and put a reverse proxy in front of it.

## How to turn UFW off or reset it

```bash theme={null}
sudo ufw disable
```

`sudo ufw reset` turns UFW off and deletes all your rules. Use it only from the VNC console or when you plan to re-add SSH straight away.

## Frequently asked questions

### Why can I not connect after enabling UFW?

The port is probably not allowed, or the service listens on a different port. Run `sudo ufw status` and `sudo ss -tulpn` and compare them. If SSH is blocked, use the VNC console and see [fix being locked out after a firewall change](https://help.freakhosting.com/portals/other/how-to-fix-locked-out-after-firewall-change.md).

### Do UFW rules survive a reboot?

Yes. After `sudo ufw enable`, UFW and its rules load at every boot.

### Does UFW protect against DDoS attacks?

No. UFW runs on your server, so the traffic has already reached it. Network-level filtering happens before your server; see [apply DDoS filters](https://help.freakhosting.com/portals/firewall/how-to-apply-ddos-filters.md).

### Where are UFW logs?

On Ubuntu, blocked connections appear in `/var/log/ufw.log` with the prefix `[UFW BLOCK]`. Turn logging on with `sudo ufw logging on`. On Debian 12 and 13 without rsyslog, use `sudo journalctl -k | grep UFW`.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Set up firewalld](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-firewalld.md)
>
> Firewall for AlmaLinux and Rocky.

> [card] [nftables and iptables](https://help.freakhosting.com/portals/other/how-to-use-nftables-and-iptables.md)
>
> Write rules without a front end.

> [card] [Check open ports](https://help.freakhosting.com/portals/other/how-to-check-open-ports-on-linux.md)
>
> See what is listening.

> [card] [Locked out after a firewall change](https://help.freakhosting.com/portals/other/how-to-fix-locked-out-after-firewall-change.md)
>
> Get back into your server.

> [card] [Firewall panel](https://help.freakhosting.com/portals/firewall/firewall-panel-overview.md)
>
> Filter traffic before it reaches your server.

***

> [!NOTE]
>
> **Checked against the official [Ubuntu Server firewall documentation](https://ubuntu.com/server/docs/how-to/security/firewalls/)** on 4 November 2026; every rule on this page was tested with `ufw --dry-run` on Ubuntu 24.04 LTS (ufw 0.36.2). Commands can differ on other distributions or releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.