Security guide

How to Set Up a UFW Firewall on Ubuntu and Debian

By Gander Web · Published 16 October 2026 · 3 min read

UFW (Uncomplicated Firewall) is a front end for the Linux kernel's firewall. Ubuntu installs it but leaves it switched off. On Debian, install it first with sudo apt install ufw. AlmaLinux and Rocky use firewalld instead, managed with firewall-cmd.

Allow SSH first

Turning UFW on without an SSH rule cuts off your own session. Add the rule first:

sudo ufw allow OpenSSH

OpenSSH is an application profile for port 22. If SSH runs on another port, allow that instead, for example sudo ufw allow 2222/tcp. Run sudo ufw app list to see the profiles on your server.

Set the defaults

sudo ufw default deny incoming
sudo ufw default allow outgoing

These are UFW's defaults already, so this only makes sure. Inbound connections are blocked unless a rule allows them, and the server can still connect out for updates.

Open the ports your services use

Open only what's running. A database should almost never be open to the whole internet.

Turn UFW on

sudo ufw enable
sudo ufw status verbose

UFW warns that enabling may disrupt existing SSH connections. With the SSH rule in place it won't, so answer y. UFW starts again by itself after a reboot.

Restrict SSH to your own IP

If you always connect from the same fixed IP, close SSH to everyone else. Add the narrow rule, then delete the broad one:

sudo ufw allow from 203.0.113.10 to any port 22 proto tcp
sudo ufw delete allow OpenSSH

Only do this with a fixed IP. Most home broadband addresses change, and when yours does you'll need the browser console for your VPS in Virtualizor to get back in. If your IP isn't fixed, rate-limit SSH instead. This blocks an address that opens six or more connections within 30 seconds:

sudo ufw limit OpenSSH

Delete or change rules

sudo ufw status numbered
sudo ufw delete 3

Rule numbers shift after each delete, so list them again before deleting another. You can also delete a rule by repeating it after delete, for example sudo ufw delete allow 80,443/tcp.

Docker bypasses UFW

Docker writes its own firewall rules, so a port you publish with -p 8080:80 is reachable from the internet even if UFW blocks 8080. To keep a container private, publish it on localhost only with -p 127.0.0.1:8080:80, and put a reverse proxy such as Nginx in front of it.

If you lock yourself out

Open the browser console for your VPS in Virtualizor, log in, and run sudo ufw disable. Add the missing rule, then turn UFW back on.

Questions

Related guides

Sources

1. ufw manual page (Debian 12)

Commands are for Ubuntu 24.04, Debian 12 and AlmaLinux 9, as of 16 October 2026. If something here no longer matches what you see, tell us and we'll update it.