How to Configure UFW Firewall on an Ubuntu VPS Print

How to Configure UFW Firewall on an Ubuntu VPS

UFW (Uncomplicated Firewall) is a firewall management tool for Linux that provides a straightforward way to control incoming and outgoing network connections. It is commonly used to secure Ubuntu VPS servers by restricting access to authorized services and IP addresses.

In this guide, you will learn how to install and configure UFW on an Ubuntu VPS, protect SSH access, open web server ports, restrict connections by IP address, manage IPv6 rules, and troubleshoot firewall problems.

These instructions apply to Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and other supported Ubuntu releases.

Prerequisites

• An Ubuntu VPS with root or sudo access.
• SSH access to your server.
• Knowledge of your SSH listening port.
• Access to your VPS provider's recovery console, if available.

Need a Linux server? Explore Owned Networks KVM VPS hosting for full root access and flexible hosting resources.

1. Install UFW on Ubuntu

Update your package repositories and install UFW:

sudo apt update
sudo apt install -y ufw

Check the current firewall status:

sudo ufw status verbose

On a new installation, UFW may report:

Status: inactive

Important: Do not enable UFW until you have explicitly allowed your SSH connection. Otherwise, you may lose remote access to your VPS.

2. Allow SSH Before Enabling UFW

First, identify the port used by your SSH server:

sudo sshd -T | grep '^port '

For the default SSH port (22), allow incoming connections:

sudo ufw allow 22/tcp

If your SSH server uses a custom port, such as 2222, allow that port instead:

sudo ufw allow 2222/tcp

Replace 2222 with your actual SSH port.

Verify the configured rules:

sudo ufw show added

Security recommendation: Keep your current SSH session open while configuring the firewall. Test a new SSH connection before closing your original session.

3. Configure Default Firewall Policies

For a typical VPS, a secure starting point is to deny unsolicited incoming connections while allowing outgoing traffic.

sudo ufw default deny incoming
sudo ufw default allow outgoing

This configuration blocks incoming connections unless they match an explicit allow rule.

Existing and established connections are normally handled by UFW's connection-tracking rules.

4. Enable the UFW Firewall

After confirming that SSH access is allowed, enable UFW:

sudo ufw enable

Confirm the warning if prompted.

Check the active firewall rules:

sudo ufw status verbose

Example output:

Status: active
Default: deny (incoming), allow (outgoing)

Open a second terminal and verify that you can still connect to your VPS using SSH.

5. Allow HTTP and HTTPS Traffic

If your VPS hosts websites, allow incoming connections on ports 80 and 443:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Alternatively, if Nginx is installed, you can use its predefined application profile:

sudo ufw allow 'Nginx Full'

For Apache:

sudo ufw allow 'Apache Full'

These profiles allow HTTP and HTTPS traffic.

Use either the individual port rules or the appropriate application profile. Adding both is generally unnecessary.

6. Allow a Custom TCP or UDP Port

To allow incoming TCP connections on a specific port:

sudo ufw allow 8080/tcp

To allow incoming UDP connections:

sudo ufw allow 51820/udp

To allow a range of TCP ports:

sudo ufw allow 30000:30100/tcp

Security recommendation: Open only the ports required by your applications. Avoid exposing administrative interfaces or database services unnecessarily.

7. Restrict SSH Access to a Specific IP Address

For additional protection, you can restrict SSH access to a trusted public IP address.

For example:

sudo ufw allow from 203.0.113.10 to any port 22 proto tcp

Replace 203.0.113.10 with your actual trusted public IP address and 22 with your SSH port.

Before removing any existing unrestricted SSH allow rule, verify that the new restricted rule works from your trusted IP.

After successful testing, list the firewall rules:

sudo ufw status numbered

Remove the unrestricted SSH rule by its number:

sudo ufw delete RULE_NUMBER

Replace RULE_NUMBER with the number displayed by UFW.

Important: Rule numbers change after deletions. Run sudo ufw status numbered again before deleting additional rules.

8. Block a Specific IP Address

To block incoming traffic from a specific IP address:

sudo ufw deny from 203.0.113.50

Replace the example address with the IP you want to block.

For a specific destination port:

sudo ufw deny from 203.0.113.50 to any port 22 proto tcp

UFW evaluates rules according to its rule-processing order. If an earlier allow rule matches the same traffic, a later deny rule may not produce the intended result.

Use sudo ufw status numbered to review rule ordering. Where necessary, use ufw insert to place a specific restriction before broader allow rules.

9. Configure IPv6 Firewall Rules

If your VPS has IPv6 connectivity, ensure UFW manages IPv6 traffic as well as IPv4.

Check the UFW configuration:

grep '^IPV6=' /etc/default/ufw

For systems using IPv6, the setting should normally be:

IPV6=yes

After changing this setting, reload UFW:

sudo ufw reload

Verify the rules:

sudo ufw status verbose

When IPv6 support is enabled, UFW typically creates corresponding IPv6 rules for applicable port-based commands.

Important: IPv6 firewall configuration should be reviewed before exposing services through public IPv6 addresses. Do not assume IPv4-only restrictions also protect IPv6 traffic.

10. View and Manage Firewall Rules

Display active rules:

sudo ufw status

Display detailed firewall information:

sudo ufw status verbose

Display numbered rules:

sudo ufw status numbered

Delete a rule using its original command:

sudo ufw delete allow 8080/tcp

Reload the firewall:

sudo ufw reload

Disable UFW:

sudo ufw disable

Reset UFW to its default configuration:

sudo ufw reset

Warning: Resetting UFW removes configured rules and disables the firewall. Do not use this command on a production VPS without planning and verifying your recovery access.

11. Enable UFW Logging

UFW supports firewall logging to help investigate blocked connections and troubleshoot network access.

Enable low-level logging:

sudo ufw logging low

Check firewall logs:

sudo journalctl -k | grep UFW

On systems configured to write UFW logs to a dedicated file, you may also find:

/var/log/ufw.log

Logging availability depends on the system's logging configuration.

To disable UFW logging:

sudo ufw logging off

12. UFW and Docker: Important Security Considerations

If your Ubuntu VPS runs Docker, be aware that published container ports may bypass some UFW filtering rules because Docker manages its own firewall rules.

For example, publishing a container port using:

docker run -p 8080:80 nginx

may expose the container service even when UFW does not explicitly allow port 8080.

For services that should only be accessible locally, bind the published port to the loopback interface:

docker run -p 127.0.0.1:8080:80 nginx

For more complex environments, review Docker's firewall integration and the appropriate container traffic filtering mechanisms.

Security recommendation: Do not rely exclusively on UFW to protect Docker-published ports. Verify actual network exposure from outside the VPS.

13. Troubleshooting Common UFW Problems

SSH connection blocked: Verify that the correct SSH port is allowed and that no restrictive rule blocks your source IP.

sudo ufw status numbered
sudo ss -tlnp | grep sshd

If you lose SSH access, use your VPS provider's recovery console to inspect and correct firewall rules.

Website inaccessible: Confirm that ports 80 and 443 are allowed and that the web server is running.

sudo ufw status
sudo ss -tlnp | grep -E ':80|:443'

Port allowed but connection fails: Verify the application is listening on the correct network interface. A firewall allow rule does not make a service accessible if it listens only on localhost.

IPv6 connection problems: Check IPv6 addressing, UFW IPv6 support, and any provider-level firewall restrictions.

Docker ports unexpectedly accessible: Review Docker port publishing and container firewall behavior.

14. UFW Security Best Practices

• Always allow SSH before enabling UFW.
• Use a default-deny policy for incoming traffic.
• Open only ports required by your applications.
• Restrict administrative access to trusted IP addresses where practical.
• Review IPv4 and IPv6 firewall rules.
• Use SSH key authentication instead of passwords.
• Review firewall rules after installing new services.
• Use provider-level firewall controls as an additional security layer where available.
• Maintain access to a recovery console.
• Test firewall changes before closing your active SSH session.

Related Ubuntu VPS Tutorials

• How to Set Up and Secure a New Ubuntu VPS
• How to Set Up SSH Key Authentication on an Ubuntu VPS
• How to Install and Configure Nginx on an Ubuntu VPS
• How to Install and Configure Apache on an Ubuntu VPS
• How to Install Docker and Docker Compose on Ubuntu

Secure Your VPS with Owned Networks

Deploy your applications on an Owned Networks KVM VPS with full root access and flexible server resources.

Whether you host websites, databases, Docker containers, or development environments, properly configuring your firewall is an essential step in securing your Linux infrastructure.

Explore Owned Networks VPS Hosting and deploy your next Ubuntu server today.