ufw Setup Step by Step: Linux Firewall Guide 2026

curl -sSL https://cp.lv/scripts/nastrojka-ufw-poshagovo.sh | sudo bash

wget -qO- https://cp.lv/scripts/nastrojka-ufw-poshagovo.sh | sudo bash

#!/usr/bin/env bash
# Basic ufw firewall setup (Ubuntu/Debian)
set -euo pipefail

# 1. Install
sudo apt update && sudo apt install -y ufw

# 2. Default policies: deny everything inbound, allow outbound
sudo ufw default deny incoming
sudo ufw default allow outgoing

# 3. IMPORTANT: allow SSH before enabling, otherwise you lock yourself out
sudo ufw allow OpenSSH
sudo ufw limit OpenSSH

# 4. Web ports: HTTP and HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# 5. Logging and enable (--force skips the interactive confirmation)
sudo ufw logging on
sudo ufw --force enable

# 6. Verify
sudo ufw status verbose
echo "Done: the firewall is on; SSH, HTTP and HTTPS are open."

ufw (Uncomplicated Firewall) is a simple wrapper around iptables. The basic setup is four commands: deny all incoming traffic, allow outgoing, open SSH and enable the firewall. Below is the full sequence with the checks that keep you from losing access to the server.

What ufw does

By default a server accepts connections on every open port. ufw lets you state explicitly which ports are reachable from outside and block everything else. It is the first line of defence on any VPS.

Step 1. Installation

On Ubuntu ufw is usually already installed. If it is not:

apt update
apt install -y ufw

Step 2. Default policies

ufw default deny incoming
ufw default allow outgoing

All incoming traffic is now blocked and outgoing traffic is allowed.

Step 3. Important: allow SSH before enabling

If you turn the firewall on without an SSH rule, you lose access:

ufw allow OpenSSH

Or by port number (if SSH runs on a non-standard port):

ufw allow 2222/tcp

Step 4. Web ports

For a website or an API, open HTTP and HTTPS:

ufw allow 80/tcp
ufw allow 443/tcp

You can also use application profiles:

ufw app list
ufw allow 'Nginx Full'

Step 5. Enabling the firewall

ufw enable

Confirm with y. Check the status:

ufw status verbose

The output shows the active rules and the default policies.

Restricting access by IP

Allowing SSH only from your own address dramatically reduces brute-force risk:

ufw allow from 203.0.113.10 to any port 22 proto tcp

Allow a whole subnet:

ufw allow from 192.168.1.0/24

Block a specific address:

ufw deny from 198.51.100.5

Protecting SSH from brute force

The limit rule blocks an IP that opens more than 6 connections in 30 seconds:

ufw limit OpenSSH

It is a good complement to fail2ban.

Managing rules

Show the rules with numbers:

ufw status numbered

Delete a rule by number:

ufw delete 3

Delete it by description:

ufw delete allow 80/tcp

Logging

ufw logging on
ufw logging medium

Logs are written to /var/log/ufw.log. To watch them live:

tail -f /var/log/ufw.log

Handy commands

Application profiles

ufw ships with ready port profiles for popular services. To list them:

ufw app list

Profile details:

ufw app info 'Nginx Full'

Profiles keep rules readable: instead of 80,443/tcp you get a clear Nginx Full.

IPv6 configuration

If the server has IPv6, make sure ufw manages it too. In /etc/default/ufw:

IPV6=yes

Restart the firewall after the change:

ufw disable && ufw enable

allow and deny rules then apply to both protocols automatically.

Rule order matters

ufw processes rules top to bottom and stops at the first match. That is why deny rules for specific addresses have to go ABOVE the general allow rules. To insert a rule at position 1:

ufw insert 1 deny from 198.51.100.5

Check the order with ufw status numbered.

Backup and restore

ufw rules are plain text files. Save them:

cp -r /etc/ufw /root/ufw-backup

When you migrate to a new server, put the files back and restart ufw. That is much faster than typing dozens of rules again.

Frequently asked questions

Will I lose access when I enable it? Only if you forgot ufw allow OpenSSH. Always open the SSH port before ufw enable.

Can I use ufw and iptables together? ufw manages iptables for you. Manual iptables rules can conflict with it — pick one or the other.

How do I open a port range? ufw allow 6000:6010/tcp opens ports 6000 through 6010.

Do I need ufw if I already run fail2ban? Yes, they work at different levels: ufw closes unnecessary ports, fail2ban bans offenders on the open ones. Use both.

How do I turn the firewall off temporarily? Run ufw disable, and ufw enable when you are done. The rules are preserved.

A firewall is the minimum any server needs. Deploy your project on a VPS for security and VPN or a standard VPS plan. The full setup can be done by Server administration.