ufw: Firewalls
UFW has been installed by default since Ubuntu 8.04 LTS. Check the version to confirm that the system is ready.
sudo ufw version
This shows the UFW version, for example `ufw 0.36.2`. If the command is not found, install it with `sudo apt install ufw`.
2. Enable UFW
Activate the firewall with the default command. Be careful: after activation, all incoming traffic is blocked unless you have added rules.
sudo ufw enable
The output confirms with `Firewall is active and enabled on system startup`. The system will then always start with an active firewall.
3. View the current status and rules
Show the active rules with numbering. This makes it easy to identify and manage specific rules later.
sudo ufw status numbered
Without rules, this shows `Status: active` with an empty list. Add rules first before using the firewall in production.
4. Allow incoming traffic on a port
Allow traffic on port 5432 and document the rule with a comment. This is useful for services such as PostgreSQL.
sudo ufw allow 5432 comment "Service"
The comment feature helps record the purpose of each rule. This becomes visible in the status output.
5. Allow traffic from a specific IP address
Restrict access to port 22 (SSH) to a single IP address. This is an example of a rule with multiple conditions.
sudo ufw allow proto tcp from 192.168.0.4 to any port 22
Only TCP traffic from 192.168.0.4 to port 22 is allowed. All other SSH connections are blocked.
6. Disable UFW if necessary
Use this command to completely disable the firewall. This is only recommended for test environments or when troubleshooting network issues.
sudo ufw disable
The output confirms with `Firewall stopped and disabled on system startup`. The system will then start without an active firewall.
7. Check the interaction with Docker
If you use Docker, check whether published container ports bypass UFW rules. Docker creates its own firewall rules for network isolation and port publishing — these bypass UFW.
sudo iptables -L DOCKER -n --line-numbers
This output shows the Docker firewall rules. Note: these rules are necessary for Docker bridge networks and should not be modified manually.
8. Add a default deny rule for incoming traffic
Set the default policy for incoming traffic. This ensures that all traffic not explicitly allowed is blocked.
sudo ufw default deny incoming
This is a best practice for servers: only the ports you explicitly open are reachable. Outgoing traffic remains allowed by default.
Verification
Check that the firewall works correctly by viewing the status and performing a port scan from another system.sudo ufw status verbose
This shows the active policy, including the default rules and all added rules. For an external check, use `nmap` from another system:
nmap -p 22 192.168.0.10
If UFW is configured correctly, this shows port 22 as `filtered` or `open`, depending on your rules.
Common issues
1. Docker ports are reachable despite UFW rulesDocker bypasses UFW by creating its own iptables rules. This is known behavior. Solve it by not publishing Docker container ports on the host (omitting `-p`) and using a reverse proxy that is managed by UFW instead.
2. UFW blocks SSH after activation
This happens when you did not allow SSH before `sudo ufw enable`. Restore access with:
sudo ufw allow 22/tcp
Always add this rule before enabling the firewall on a remote server.
3. Rules are not applied after a reboot
Check whether UFW is enabled at startup:
sudo systemctl status ufw
If the service is not active, start it with `sudo systemctl enable --now ufw`. UFW must be active to apply rules after a reboot.
UFW remains an essential part of Ubuntu's security architecture — but the growing role of containers and the interaction with Docker firewall rules make it increasingly important to know where the limits of this tool lie.