How to Use UFW: An Ubuntu Firewall Guide
How to use UFW on Ubuntu: enabling the firewall safely, port and IP rules, deleting rules, application profiles, rate limiting, IPv6 and Docker.
UFW (Uncomplicated Firewall) is a tool that lets you manage the firewall on Ubuntu and Debian servers with simple commands. It runs on top of the Linux kernel's packet filtering framework and lets you use readable commands such as ufw allow 443/tcp instead of long iptables rules. A properly configured firewall makes sure that only the services you actually use on your server can be reached from outside.
This guide covers enabling UFW safely, port and IP rules, deleting rules, application profiles, rate limiting, IPv6, logs and what to watch out for when using it together with Docker. You can find out how ports work in our What is a port? article.
Installing and enabling it safely
UFW usually comes preinstalled on Ubuntu. If it isn't installed:
sudo apt install ufw
Before enabling it, set the default rules and make sure to allow SSH:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable
default deny incoming: Blocks every incoming connection you haven't explicitly allowed.default allow outgoing: Allows the server to connect out (updates, APIs).allow OpenSSH: Makes sure your SSH connection isn't cut off. If you run SSH on a different port, open that port instead, for examplesudo ufw allow 2222/tcp.
If you skip this step, your SSH connection will be cut off after the enable command. If you've locked yourself out, you can connect through your provider's web console and add the rule.
To see the status and the rules:
sudo ufw status verbose
Port rules
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 25565/tcp
sudo ufw allow 27015/udp
sudo ufw allow 30120
sudo ufw allow 2456:2457/udp
- If you specify a protocol (
/tcp,/udp), only that protocol is opened. If you don't (30120), the port is opened for both TCP and UDP. - Port ranges are written with a colon, and specifying the protocol is required (
2456:2457/udp).
Use deny to explicitly block a port, and reject to send the client a rejection response instead of silently dropping the connection.
Rules by IP address
Opening management ports only to your own IP address is one of the most effective security habits:
sudo ufw allow from 198.51.100.7 to any port 3306 proto tcp
sudo ufw allow from 198.51.100.0/24 to any port 22 proto tcp
sudo ufw deny from 203.0.113.50
- The first rule opens the MariaDB port to a single IP address only.
- The second rule opens SSH to an IP range.
- The third rule blocks all connections from one IP address.
Rule order matters. UFW evaluates rules from top to bottom and applies the first one that matches. If you want to block a specific address from a port that's open to everyone, insert the block rule at the top of the list:
sudo ufw insert 1 deny from 203.0.113.50
Listing and deleting rules
sudo ufw status numbered
sudo ufw delete 3
The first command lists the rules with their numbers; the second deletes the rule with the given number. You can also delete a rule by writing it out:
sudo ufw delete allow 80/tcp
The numbers change as rules are deleted; if you're deleting more than one rule, check the list again each time. To delete all the rules and start over, use sudo ufw reset; this command also turns UFW off.
Application profiles
Some packages install ready-made profiles for UFW. To see the available profiles:
sudo ufw app list
For example, if Nginx is installed, the Nginx Full profile opens ports 80 and 443 together:
sudo ufw allow 'Nginx Full'
Profiles save you from having to remember which ports a service uses.
Rate limiting: ufw limit
A limit rule temporarily blocks an IP address when many connection attempts come from it in a short time. By default, addresses that make 6 or more connection attempts within 30 seconds are blocked:
sudo ufw limit OpenSSH
This slows down automated password-guessing attacks on SSH. For more flexible, log-based protection, take a look at our How to install Fail2ban guide; the real protection, though, is key-based login for SSH.
IPv6
Make sure UFW applies rules for IPv6 too. In the /etc/default/ufw file:
IPV6=yes
With this setting on, every rule you add applies to both protocols; in the ufw status output you'll see rules marked with (v6). If you changed the setting, run sudo ufw reload. The details are in our What is IPv6? article.
Logs
To see the connections UFW blocks, turn logging on:
sudo ufw logging on
sudo tail -f /var/log/ufw.log
Lines in the log that start with [UFW BLOCK] show blocked connections. This is very useful when you're trying to find out why a service can't be reached. You can set the log level with values such as sudo ufw logging medium; higher levels can fill up the disk quickly.
Using it with Docker
If you use Docker, the most important thing to know is: ports published by Docker bypass UFW rules. Docker adds its own iptables rules for the ports you open with -p or ports:, and those rules are processed before UFW. That's why a port that looks closed in UFW can be open to the internet.
Bind ports that should only be reachable from inside the server to the local address:
ports:
- '127.0.0.1:3306:3306'
The details are in our How to install Docker guide.
Common commands
| Command | What it does |
|---|---|
sudo ufw status verbose | Shows the status and all the rules |
sudo ufw allow 443/tcp | Opens a port |
sudo ufw allow from IP to any port N | Opens a port to a single IP address only |
sudo ufw deny from IP | Blocks an IP address |
sudo ufw status numbered | Lists the rules with their numbers |
sudo ufw delete N | Deletes the rule with the given number |
sudo ufw limit OpenSSH | Applies a rate limit to SSH |
sudo ufw reload | Reloads the rules |
sudo ufw disable | Turns the firewall off |
For general server security, take a look at our Linux server security checklist as well.
The firewall on Nodesty servers
When you choose Ubuntu or Debian on Nodesty AMD Ryzen 9 9950X VPS and AMD EPYC 7763 VPS plans, you can set up your firewall with UFW in a few commands. We don't block game ports or UDP traffic on virtual servers by default; you decide which ports are open. L3–L7 nShield DDoS protection filters network-level attacks before they reach your server, and if you lose SSH access, you can always reach your server through the web console in your panel.
Frequently Asked Questions
Will enabling UFW cut off my SSH connection?
Yes, if you enable UFW without adding a rule for SSH; the default rule blocks all incoming connections. Always run sudo ufw allow OpenSSH before turning UFW on. If you've locked yourself out, you can connect to the server through your provider's web console and add the rule.
What's the difference between UFW and iptables?
iptables and nftables are tools that manage the Linux kernel's packet filtering framework directly, and writing rules with them is more complex. UFW is a simple interface that runs on top of this framework; it lets you write the same rules with much shorter, more readable commands.
Why don't the ports Docker opens get caught by UFW?
Docker adds its own iptables rules for the ports it publishes, and those rules are processed before UFW's rules. That's why a port that looks closed in UFW can be open to the outside through Docker. Bind ports that should only be reachable from inside the server to 127.0.0.1.
Do my UFW rules survive a reboot?
Yes. UFW rules are persistent, and if UFW is enabled they're applied automatically every time the server starts. With sudo ufw status verbose you can see whether UFW is enabled and list all the rules.
Can I use UFW on AlmaLinux?
On AlmaLinux and Rocky Linux the default firewall is firewalld, and we recommend using it. Running two firewall tools at the same time can lead to conflicting rules.
Can I block connections from a specific country?
UFW itself has no country-based blocking. For that, people use ipset or similar tools with lists of IP ranges assigned to countries. However, these lists change constantly and don't stop attackers who use a VPN; strong authentication and closed ports provide the real protection.
About the author
Nodesty Team · Infrastructure & Support
The Nodesty team runs our servers, network and DDoS protection day to day and answers customer support requests around the clock. These guides come from that work.
Related articles
HTTP Security Headers: HSTS, CSP and More
What are HTTP security headers? HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, adding them with Nginx and .htaccess, and testing.
What Is an SSH Tunnel? A Port Forwarding Guide
What is an SSH tunnel and how do you set one up? Local, remote and dynamic port forwarding, secure database and panel access, ~/.ssh/config and autossh.
Website Hacked? What to Do, Step by Step
Website hacked? What to do: the signs, first response, passwords, finding malicious files, restoring a clean backup, WordPress cleanup and prevention.