UFW Firewall Linux | Setup & Configuration Guide

Q: How do I allow SSH through UFW?

Run sudo ufw allow OpenSSH (or sudo ufw allow 22/tcp if you use the default port), and do this before running sudo ufw enable on a remote server.

Q: How do I see which UFW rules are active?

Run sudo ufw status verbose for the policies and every active rule, or sudo ufw status numbered when you need the rule numbers to delete one.

Q: How do I completely reset UFW?

sudo ufw reset disables UFW and removes all rules, returning it to its default inactive state. You will need to re-add your allow rules, including SSH, before enabling it again.

UFW (Uncomplicated Firewall) is a friendly front end over the kernel’s packet filter, built to make firewall rules readable without memorising raw
iptables or nftables syntax. It ships on Ubuntu by default and is available on Debian and other distributions.

This guide sets sane default policies, allows SSH before enabling the firewall (the step that saves you from locking yourself out of a remote server),
allows common services, and verifies from the outside rather than trusting the configuration alone.

Quick answer: sudo ufw allow OpenSSH first, then sudo ufw enable, never the other way around on a remote box.

What UFW Actually Does

UFW does not filter packets itself — it translates simple commands into rules for the kernel’s real packet filter (iptables or nftables, depending on the distribution) and manages them for you.

architectureufw-flow.txt

  ufw allow 22/tcp  -->  UFW translates the rule  -->  kernel packet filter enforces it

UFW as a front end — Simple commands, kernel enforces them

Set Default Policies First

Start from a known state: deny everything incoming by default, allow everything outgoing. Every service you actually need gets an explicit allow rule on top of this.

bashdefaults

sudo ufw default deny incoming
sudo ufw default allow outgoing

Default policies — Deny in, allow out, then add exceptions

Allow SSH Before You Enable the Firewall

This is the step people skip and then get locked out over. If you are connected over SSH, allow it explicitly before turning UFW on, or the very next command can cut your own session.

bashthe safe order

sudo ufw allow OpenSSH
sudo ufw status
sudo ufw enable

WarningIf you use a non-default SSH port, allow that exact port instead: sudo ufw allow 2222/tcp. Confirm the rule exists with ufw status before enabling.

Allow SSH first — Confirm it, then enable

Allow the Services You Actually Run

Add a rule per service, or per source address for something that should only be reachable from a specific network.

bashcommon allows

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow from 10.0.0.0/24 to any port 3306
ufw app list

Allowing services — Ports, app profiles, or specific sources

Remove Rules Safely

List rules with numbers first so you delete the exact one you mean, not a similar-looking one.

bashdelete by number

sudo ufw status numbered
sudo ufw delete 3
sudo ufw status numbered

Deleting rules — Numbered list, then delete by number

Turn On Logging and Rate Limiting

Logging shows what is being blocked, which is invaluable when a legitimate connection unexpectedly fails. limit throttles repeated connection attempts on a port, which is a cheap defence against basic brute-force scans on SSH.

bashlogging and rate limiting

sudo ufw logging medium
sudo ufw limit 22/tcp
sudo tail -f /var/log/ufw.log

Logging and limiting — Medium logging, limit on SSH

Don’t Forget IPv6

UFW manages IPv6 rules alongside IPv4 once enabled in its own configuration file, and every rule you add applies to both automatically after that.

ini/etc/default/ufw

IPV6=yes

bashconfirm

sudo ufw status verbose

IPv6 in UFW — One setting, then rules cover both

Verify From the Outside, Not Just the Config

A rule that looks right in ufw status can still be undermined by a cloud provider’s separate security group, a Docker network bypassing UFW, or a typo in a port number. Confirm from another machine.

bashon the server

sudo ufw status verbose

bashfrom a different machine

nmap -Pn -p 22,80,443 your-server-ip

NoteDocker containers publish ports through their own iptables rules and can bypass UFW’s normal filtering. If a container’s port is reachable when it shouldn’t be, that’s usually why.

Verifying from outside — Don’t trust the config alone

How do I allow SSH through UFW?

Run sudo ufw allow OpenSSH (or sudo ufw allow 22/tcp if you use the default port), and do this before running sudo ufw enable on a remote server.

What is the default UFW policy?

Out of the box UFW has no rules and is inactive. The recommended starting policy, set explicitly, is deny all incoming and allow all outgoing, with specific services allowed on top.

How do I see which UFW rules are active?

Run sudo ufw status verbose for the policies and every active rule, or sudo ufw status numbered when you need the rule numbers to delete one.

Does UFW work with Docker?

Not cleanly by default. Docker inserts its own iptables rules to publish container ports, which can bypass UFW’s filtering entirely. This needs specific extra configuration beyond the scope of basic UFW usage.

How do I completely reset UFW?

sudo ufw reset disables UFW and removes all rules, returning it to its default inactive state. You will need to re-add your allow rules, including SSH, before enabling it again.

Cheat Sheet

Default deny incoming, allow outgoing; allow SSH before ufw enable
ufw status numbered to find rules, ufw delete N to remove them
Verify open ports from a different machine, not just ufw status

UFW Firewall Basics: Secure Your Linux Server