UFW firewall setup: deny by default, open what you serve

UFW (Uncomplicated Firewall) is the friendly front-end to iptables on Debian and Ubuntu. The right mental model is simple: deny everything inbound by default, then open only the ports you actually serve. Here is the whole workflow, with the one step that prevents a lockout.

1. Allow SSH before you enable anything

sudo ufw allow OpenSSH        # or: sudo ufw allow 22/tcp
sudo ufw enable
sudo ufw status verbose

2. Open the ports you serve

sudo ufw allow 80/tcp        # HTTP
sudo ufw allow 443/tcp       # HTTPS
# or the named profile
sudo ufw allow "Nginx Full"

See which application profiles are available:

sudo ufw app list

3. Restrict sensitive ports by source

A database or admin port should never be open to the whole internet. Scope it to a single address or a private subnet:

# only your office IP may reach SSH
sudo ufw allow from 203.0.113.7 to any port 22

# only the private network may reach MySQL
sudo ufw allow from 10.0.0.0/24 to any port 3306

4. Inspect and remove rules

sudo ufw status numbered      # each rule gets an index
sudo ufw delete 3             # remove rule #3

5. Confirm the default policy

The safe posture is deny-inbound, allow-outbound. UFW sets this by default, but verify:

sudo ufw default deny incoming
sudo ufw default allow outgoing

Do not forget the upstream firewall

Many hosts add a network firewall in front of the machine. If a port is open in UFW but still unreachable, check the provider’s control panel — the block may be upstream, not on the OS.

Optional: rate-limit and quiet the noise

# throttles repeated connections from the same IP
sudo ufw limit OpenSSH

Pair this with key-only SSH and fail2ban for a server that shrugs off the constant background scanning of the public internet. VMHeaven KVM plans give you full control over the OS firewall plus DDoS protection at the network edge — see the Standard KVM line.

Frequently asked