UFW Firewall Cheat Sheet

Set up UFW on Ubuntu/Debian safely: allow SSH first, set default policies, open web ports, use app profiles and troubleshoot.

A practical reference for configuring UFW on Ubuntu and Debian servers without locking yourself out.

What UFW is

UFW (Uncomplicated Firewall) is a front end that generates and manages iptables / nftables rules for you. You write simple allow and deny statements; UFW compiles them into the kernel firewall. It does not replace the packet filter, it drives it.

Install

sudo apt update       # refresh the package index
sudo apt install ufw  # install UFW itself

Check status and version

sudo ufw status            # active or inactive
sudo ufw status verbose    # policies, logging, per-rule detail
sudo ufw version

Most important warning: allow SSH before enabling

On a remote server, enabling UFW while incoming traffic is denied by default will drop your SSH session and lock you out. Add a rule for the SSH port you actually use before running ufw enable.

Default SSH port:

sudo ufw allow 22/tcp   # allow the default SSH port

Custom SSH port (for example 2222):

sudo ufw allow 2222/tcp   # allow SSH on a custom port instead of 22

Confirm the rule is listed, then continue. If you use a cloud provider, keep a web console or serial console open as a fallback while testing.

Recommended default policies

sudo ufw default deny incoming    # block all inbound traffic unless explicitly allowed
sudo ufw default allow outgoing   # let the server initiate outbound connections freely

This blocks all inbound traffic except what you explicitly allow, while letting the server make outbound connections (updates, DNS, package mirrors).

Enable and disable

sudo ufw enable     # start firewall, load rules, enable at boot
sudo ufw disable    # stop firewall and disable at boot

View active rules

sudo ufw status numbered   # rules with index numbers (needed for deletion)
sudo ufw status verbose    # full detail including default policies and logging

Allow common ports

sudo ufw allow 22/tcp      # SSH
sudo ufw allow 80/tcp      # HTTP
sudo ufw allow 443/tcp     # HTTPS
sudo ufw allow 8080/tcp    # a custom TCP service

Allow a UDP port

sudo ufw allow 51820/udp   # e.g. WireGuard

Allow a port range

sudo ufw allow 6000:6007/tcp     # allow a range of TCP ports
sudo ufw allow 60000:61000/udp   # allow a range of UDP ports

A protocol (/tcp or /udp) is required when specifying a range.

Application profiles

Profiles live in /etc/ufw/applications.d/ and map a name to one or more ports.

sudo ufw app list             # list installed profiles
sudo ufw app info "Nginx Full"   # show what a profile opens

sudo ufw allow OpenSSH         # opens the port(s) defined by the OpenSSH app profile
sudo ufw allow "Nginx Full"    # opens 80 and 443, when the nginx package is installed

Nginx Full, Nginx HTTP and Nginx HTTPS appear only after the nginx package is installed. Use "Nginx HTTP" if you have not set up TLS yet.

Allow from a specific IP address

# From one host, to anything on this server
sudo ufw allow from 203.0.113.10

# From one host, to a single port only
sudo ufw allow from 203.0.113.10 to any port 22 proto tcp

# From a whole subnet to the database port
sudo ufw allow from 10.0.0.0/24 to any port 5432 proto tcp

Block a port or an IP address

sudo ufw deny 23/tcp                 # block Telnet
sudo ufw deny from 198.51.100.55     # block a host entirely

Rules are evaluated top to bottom, first match wins, so a deny from must sit above any broader allow for that traffic. Use insert to place it:

sudo ufw insert 1 deny from 198.51.100.55   # insert at position 1, ahead of any broader allow

Delete rules

# By rule number (check the numbers first, they shift after each delete)
sudo ufw status numbered
sudo ufw delete 3

# By repeating the original rule
sudo ufw delete allow 8080/tcp

Reload and reset

sudo ufw reload    # re-apply rules, e.g. after editing config files

sudo ufw reset disables UFW and deletes all rules, returning it to defaults. On a remote server this also removes your SSH allow rule — re-add it before enabling again.

IPv6

UFW manages IPv6 rules too, controlled by IPV6=yes in /etc/default/ufw (the default on current releases). If IPv6 rules are missing from ufw status, check that setting, then:

sudo ufw disable && sudo ufw enable   # restart UFW so the config change takes effect

Rules written without an address (sudo ufw allow 80/tcp) apply to both IPv4 and IPv6.

Minimal web server example

sudo ufw allow OpenSSH             # keep SSH access before enabling anything else
sudo ufw allow 80/tcp               # HTTP
sudo ufw allow 443/tcp              # HTTPS
sudo ufw default deny incoming      # block everything else inbound
sudo ufw default allow outgoing     # allow the server to make outbound connections
sudo ufw enable                     # turn the firewall on
sudo ufw status verbose             # confirm the rules took effect

Minimal SSH-only server (custom port)

sudo ufw allow 2222/tcp            # allow SSH on the custom port first
sudo ufw default deny incoming      # block everything else inbound
sudo ufw default allow outgoing     # allow outbound connections
sudo ufw enable                     # turn the firewall on

Make sure sshd is actually listening on 2222 (Port 2222 in /etc/ssh/sshd_config, service restarted) before enabling.

Troubleshooting

# Is the service actually listening on the port?
sudo ss -tulpn | grep :443

# Is UFW active and what does it allow?
sudo ufw status verbose

# Watch what UFW is blocking (enable logging first)
sudo ufw logging on
sudo tail -f /var/log/ufw.log
journalctl -k | grep '[UFW '

If a port is open in UFW and the service is listening but traffic still does not arrive, check your cloud provider’s firewall / security group (AWS, GCP, Azure, Hetzner, DigitalOcean). Those rules sit in front of the instance and are separate from UFW.

UFW is not the whole picture

A firewall limits exposure; it does not harden what is exposed. Keep the system patched (unattended-upgrades), use SSH key authentication with passwords disabled, run services with least privilege, and configure each service properly. UFW complements those, it does not replace them.