UFW firewall setup: deny by default, open what you serve

UFW (Uncomplicated Firewall) is the friendly front-end to iptables on Debian and Ubuntu. The right mental model is simple: deny everything inbound by default, then open only the ports you actually serve. Here is the whole workflow, with the one step that prevents a lockout.

1. Allow SSH before you enable anything

sudo ufw allow OpenSSH        # or: sudo ufw allow 22/tcp
sudo ufw enable
sudo ufw status verbose

OpenSSH always means port 22. If your server runs SSH on another port, allow that port instead (see how to find out which port SSH uses).

2. Open the ports you serve

sudo ufw allow 80/tcp        # HTTP
sudo ufw allow 443/tcp       # HTTPS
# or the named profile
sudo ufw allow "Nginx Full"

A web server needs both port 80 and port 443: 443 carries HTTPS, and 80 answers http:// links with a redirect and serves Let’s Encrypt’s HTTP-01 challenge. A mail server needs SMTP port 25 for delivery between servers and 587 or 465 for mail clients that send through it.

See which application profiles are available:

sudo ufw app list

If the site sits behind Cloudflare, ports 80 and 443 must accept Cloudflare’s address ranges. A rule that admits only your own IP there, or a ban tool that blocked a Cloudflare address, turns into Cloudflare error 522 for every visitor.

3. Restrict sensitive ports by source

A database or admin port should never be open to the whole internet. Scope it to a single address or a private subnet:

# only your office IP may reach SSH
sudo ufw allow from 203.0.113.7 to any port 22

# only the private network may reach MySQL
sudo ufw allow from 10.0.0.0/24 to any port 3306

What is my IP shows the address your connection comes from, which is the one to put in the first rule. The subnet calculator shows which addresses a range such as 10.0.0.0/24 covers before you allow it.

4. Inspect and remove rules

sudo ufw status numbered      # each rule gets an index
sudo ufw delete 3             # remove rule #3

5. Confirm the default policy

The safe posture is deny-inbound, allow-outbound. UFW sets this by default, but verify:

sudo ufw default deny incoming
sudo ufw default allow outgoing

Do not forget the upstream firewall

Many hosts add a network firewall in front of the machine. If a port is open in UFW but still unreachable, check the provider’s control panel: the block may be upstream, not on the OS.

Optional: rate-limit and quiet the noise

# throttles repeated connections from the same IP
sudo ufw limit OpenSSH

Pair this with key-only SSH and fail2ban for a server that shrugs off the constant background scanning of the public internet. VMHeaven KVM plans give you full control over the OS firewall plus DDoS protection at the network edge (see the Standard KVM line).

Frequently asked