Set up a firewall with UFW on Ubuntu and Debian

UFW (Uncomplicated Firewall) is a front end for the Linux firewall that makes common rules one-line commands. This guide sets up a deny-by-default firewall on Ubuntu 24.04/26.04 or Debian 12/13 and covers the rules you will need later. Replace 198.51.100.7 with your own IP address.

Before you start

• Log in over SSH with a sudo user, and keep the web console ready if your service page shows one.
• List the services you run and their ports: sudo ss -tulpn.

Step 1: Install UFW

UFW is preinstalled on Ubuntu. On Debian:

sudo apt install ufw

Step 2: Set defaults and allow SSH first

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH

OpenSSH is an application profile for port 22. If SSH runs on another port, allow that port instead, for example sudo ufw allow 2222/tcp.

Step 3: Allow your services

sudo ufw allow 80,443/tcp

More examples:

Keep databases and admin panels closed to the internet, or open them only to your own addresses.

Step 4: Enable and check

sudo ufw enable
sudo ufw status verbose

Verify: the status shows Status: active, Default: deny (incoming), allow (outgoing) and your rules, each for IPv4 and (v6). Open a new SSH session to confirm you still get in.

Step 5: Rate-limit SSH

Replace the plain SSH rule with a limited one, which denies an address that opens six or more connections within 30 seconds:

sudo ufw limit OpenSSH
sudo ufw delete allow OpenSSH

Managing rules

List rules with numbers and delete by number:

sudo ufw status numbered
sudo ufw delete 3

Insert a rule at a position (rules are evaluated in order):

sudo ufw insert 1 deny from 203.0.113.50

Preview what a command would do without applying it, using --dry-run, for example sudo ufw --dry-run enable.

Logging

sudo ufw logging low

Blocked packets are logged with the prefix [UFW BLOCK]; read them with sudo journalctl -k | grep UFW or in /var/log/ufw.log where rsyslog is installed.

IPv6

Check that /etc/default/ufw contains IPV6=yes. If you change it, reload with sudo ufw reload. Rules then cover both protocols.

Docker and UFW

Docker publishes container ports with its own rules, which bypass UFW. A container started with -p 8080:80 is reachable from the internet even if UFW does not allow 8080. Publish ports on 127.0.0.1 only (for example -p 127.0.0.1:8080:80) and expose them through a reverse proxy on the host. See install Docker on Ubuntu.

Troubleshooting

SSH froze right after ufw enable. SSH was not allowed. Use the console: sudo ufw allow OpenSSH. See locked out after a firewall change.

A port is open in UFW but still unreachable. The service listens on 127.0.0.1 only, or it is not running. Check sudo ss -tulpn. See ports and port forwarding.

Outgoing mail on port 25 fails although UFW allows outgoing traffic. Outbound port 25 is closed by default on HyperDC VPS. For services bought for a term of 3 months or longer, it is opened on request when you open a support ticket. Until then, send mail through a relay on port 587.

Start over. sudo ufw reset disables UFW and deletes all rules (it backs up the old ones). Add your SSH rule again before enabling.

Next steps

• More control: nftables firewall.
• Block repeated attempts: Fail2ban and CrowdSec.