Setting up UFW firewall on Ubuntu

ufw status

If you see "Command 'ufw' not found", install it with APT:

sudo apt update && sudo apt install ufw -y

2. Allow SSH access before enabling

This is the most important step. If you enable UFW without allowing SSH first, you will lock yourself out. Ubuntu provides an application profile for OpenSSH:

sudo ufw allow OpenSSH

If you use SSH on a custom port, replace the profile with the port number:

sudo ufw allow 2222/tcp

3. Enable UFW

Activate the firewall with:

sudo ufw enable

Confirm with "y" when prompted. UFW will now deny all incoming connections that are not explicitly allowed. Outgoing traffic remains allowed by default, so updates and DNS requests continue to work normally.

4. Check the status

View the active rules with:

sudo ufw status verbose

The output shows the default policy, active rules, and whether IPv6 is enabled. You should see a rule for OpenSSH (port 22) for both IPv4 and IPv6.

5. Allow services for web and database servers

Add rules for the services your server needs to reach. For a web server:

sudo ufw allow 'Nginx Full'

This profile opens both port 80 (HTTP) and port 443 (HTTPS). For an Apache web server, use `'Apache Full'`. For a MySQL database that should only be reachable internally:

sudo ufw allow from 192.168.1.0/24 to any port 3306

This restricts access to the local subnet. Never open ports to everyone if the service is only used internally.

6. View available application profiles

UFW includes predefined profiles for common services. View them with:

sudo ufw app list

Show details of a specific profile with:

sudo ufw app info 'Nginx Full'

The profiles are located in `/etc/ufw/applications.d/` and contain the ports and protocols the service uses. This saves you from having to remember port numbers manually.

7. Remove incorrect rules

If you added a wrong rule, remove it immediately. First, use a numbered list:

sudo ufw status numbered

Remove a rule by number:

sudo ufw delete 3

Remove a rule by specification:

sudo ufw delete allow 8080

After removing, always check the status to confirm the rule is gone.

8. Enable logging for monitoring

Enable logging to record firewall events:

sudo ufw logging on

By default, UFW logs to `/var/log/ufw.log` with level "low" (blocked packets). For more detail:

sudo ufw logging medium

The levels are: off, low, medium, high, full. Medium also logs allowed connections, which is useful for debugging but uses more disk space.

Verification

Check that UFW is active and contains the correct rules:

sudo ufw status verbose

The output should show "Status: active" and the rules you added. Then test whether SSH still works in a new terminal session. Also try to reach a non-allowed port from another machine:

nc -zv your-server-ip 8080

This should fail with "Connection refused" or a timeout. If the connection succeeds, the port is unintentionally open and you need to adjust the rules.

Common issues

I am locked out of my server after enabling UFW. Start the server via your hosting provider's console (out-of-band access). Log in and run `sudo ufw allow OpenSSH`, followed by `sudo ufw reload`. If SSH runs on a different port, use `sudo ufw allow /tcp`.

My web server is unreachable despite an allow rule. Check whether the service is actually listening: `sudo ss -tlnp | grep :80`. Also check if you opened the correct port: `ufw status` only shows active rules. Some profiles like `'Nginx Full'` open multiple ports — check with `sudo ufw app info 'Nginx Full'`.

UFW blocks outgoing traffic after a reboot. This is unusual — the default policy for outgoing traffic is "allow". Check with `sudo ufw status verbose` if the default outgoing policy is set to "allow". If it is set to "deny", set it back with `sudo ufw default allow outgoing`.

UFW covers the basics for host-based firewall configuration, but stops where complex network configuration begins. For NAT, port forwarding, or advanced filtering, you need to fall back on iptables or nftables — the UFW man page also refers to this. Consult `man ufw` for the full syntax and options, and keep in mind that the Ubuntu Server documentation for this topic was last updated on June 26, 2026, which means UFW is actively maintained within the community.