How to setup a Firewall with UFW on Ubuntu 18.04+

Overview

UFW (Uncomplicated Firewall) is a user-friendly interface to manage iptables firewall rules in Ubuntu and Debian-based systems. It simplifies the process of allowing and denying network traffic without complex command syntax.

Prerequisites

You’ll need:

• Root or sudo access on your Ubuntu server
• SSH connection for remote management (highly recommended)
• Basic understanding of network ports

Installation

UFW comes with Ubuntu by default. If it was removed or you’re on a minimal installation, install it with:

sudo apt update
sudo apt install ufw

Step 1: Check Current Status

UFW is disabled by default. Check the current status and existing rules:

sudo ufw status

Output will show Status: inactive on first run. No rules are loaded yet.

Step 2: Allow SSH Access (CRITICAL)

Add a rule to allow SSH connections before enabling the firewall:

sudo ufw allow ssh

Alternatively, allow by port number:

sudo ufw allow 22

If SSH runs on a custom port (recommended for security), allow that port instead:

sudo ufw allow 2222

Replace 2222 with your actual SSH port.

Step 3: Enable the Firewall

Now enable UFW:

sudo ufw enable

You’ll see a warning:

1
Command may disrupt existing ssh connections. Proceed with operation (y|n)?

Enter y — you’ve already whitelisted SSH, so your connection will remain active.

Step 4: Add Rules for Your Services

Allow Web Server (HTTP/HTTPS)

If running a web server, allow HTTP and HTTPS:

sudo ufw allow http    # Port 80
sudo ufw allow https   # Port 443

Or allow specific ports:

sudo ufw allow 80
sudo ufw allow 443

Allow Custom Application Ports

For any service, use the port number:

sudo ufw allow 3000     # Node.js development server
sudo ufw allow 5432     # PostgreSQL database
sudo ufw allow 3306     # MySQL database
sudo ufw allow 6379     # Redis cache

Allow Specific Protocols

Allow TCP-only or UDP-only traffic:

sudo ufw allow 53/tcp   # DNS over TCP
sudo ufw allow 53/udp   # DNS over UDP
sudo ufw allow 1194/udp # OpenVPN

Allow by Service Name

UFW recognizes common service names from /etc/services:

sudo ufw allow dns      # Port 53
sudo ufw allow ftp      # Port 21
sudo ufw allow smtp     # Port 25
sudo ufw allow imap     # Port 143
sudo ufw allow pop3     # Port 110

Step 5: View and Manage Rules

Check Current Rules

sudo ufw status

Output example:

1
Status: active
2

3
To                         Action      From
4
--                         ------      ----
5
22                         ALLOW       Anywhere
6
80                         ALLOW       Anywhere
7
443                        ALLOW       Anywhere
8
22 (v6)                    ALLOW       Anywhere (v6)
9
80 (v6)                    ALLOW       Anywhere (v6)
10
443 (v6)                   ALLOW       Anywhere (v6)

For detailed rule information:

sudo ufw status numbered

Deny Specific Ports

Explicitly deny a port (rarely needed due to default deny):

sudo ufw deny 80

Delete Rules

Delete by allow/deny and port:

sudo ufw delete allow 80
sudo ufw delete deny 80

Or delete by rule number (from ufw status numbered):

sudo ufw delete 3

Advanced Usage

Allow from Specific IP Address

Restrict access to a service from a single IP:

sudo ufw allow from 192.168.1.100 to any port 3306

This allows only 192.168.1.100 to access MySQL.

Allow Ranges of Ports

sudo ufw allow 6000:6007/tcp  # Allow TCP ports 6000-6007 (X11)

Enable/Disable Without Clearing Rules

sudo ufw disable        # Deactivate temporarily (rules preserved)
sudo ufw enable         # Re-enable with existing rules

Reset to Defaults

sudo ufw reset

Common Service Ports Reference

Troubleshooting

sudo systemctl enable ufw
sudo systemctl start ufw

Security Best Practices

Conclusion

UFW provides a simple yet powerful way to secure your Linux server with a default-deny firewall policy. By allowing only necessary ports and protocols, you significantly reduce your attack surface. Always prioritize SSH security to maintain remote access.