Uncomplicated Firewall (UFW) is a network packet filtering application that runs on Linux servers, and is the default firewall front end on Debian-based distributions such as Ubuntu. UFW filters network packets based on server interfaces, ports, and services, presenting a simplified command syntax over the underlying iptables or nftables rules.

This article explains how to set up firewall policies using UFW on a Linux server. It covers enabling the firewall without losing remote access, setting default policies for incoming and outgoing traffic, creating port and service rules, restricting traffic by source address and network interface, annotating rules with comments, and removing rules safely.

Prerequisites

Before you begin, you need to:

• Have access to an Ubuntu server as a non-root user with sudo privileges.
• Update the installed packages on the server.

Enable UFW

UFW ships with Ubuntu and is installed by default, but it starts in a disabled state so that a new server remains reachable. Enabling the firewall while no rules exist drops your SSH session, so add an SSH rule first.

1. Check the current firewall status.

   console Copy

   $ sudo ufw status
   

   Explain Code

   The output reports the firewall state.

   Status: inactive

   Note

   Status: inactive means UFW is installed but disabled. It does not mean the package is missing. On a distribution that does not ship UFW, install it with sudo apt install ufw before continuing.

2. Allow the SSH port so that enabling the firewall does not end your session.

   console Copy

   $ sudo ufw allow 22/tcp
   

   Explain Code

   The output confirms Rule added.

3. Enable the firewall.

   console Copy

   $ sudo ufw enable
   

   Explain Code

   The command warns that it may disrupt existing SSH connections and asks for confirmation. Enter y to proceed. UFW also configures itself to start automatically at boot.

4. Verify that the firewall is active and the SSH rule is present.

   console Copy

   $ sudo ufw status
   

   Explain Code

   The output displays the active state and the applied rules.

   Status: active
   
   To                         Action      From
   --                         ------      ----
   22/tcp                     ALLOW       Anywhere
   22/tcp (v6)                ALLOW       Anywhere (v6)

   UFW creates a matching IPv6 rule for every IPv4 rule when IPv6 support is enabled.

Set Default Policies

Default policies decide what happens to traffic that no rule matches. Setting a restrictive default for incoming traffic and a permissive default for outgoing traffic gives you a deny-by-default posture while leaving the server able to reach package repositories and other external services.

1. Allow all outgoing connections from the server.

   console Copy

   $ sudo ufw default allow outgoing
   

   Explain Code

2. Deny all incoming connections to the server.

   console Copy

   $ sudo ufw default deny incoming
   

   Explain Code
   Note

   This policy blocks every inbound connection that no rule explicitly allows, including SSH. Confirm that the SSH rule from the previous section is present before applying it.

3. Deny all forwarded traffic.

   console Copy

   $ sudo ufw default deny forward
   

   Explain Code

   This policy blocks traffic routed through the server. Leave forwarding allowed if the server acts as a NAT gateway or router for other hosts.

4. Review the policies together with the rule list.

   console Copy

   $ sudo ufw status verbose
   

   Explain Code

   The output reports the default policies on the Default line.

Allow Specific Ports

Port rules are the most common UFW rules. A rule that names only a port number covers both TCP and UDP, while appending a protocol restricts the rule to that protocol alone.

1. Allow a port for both protocols, such as the HTTP port 80.

   console Copy

   $ sudo ufw allow 80
   

   Explain Code

2. Allow a port for TCP only, such as the HTTPS port 443.

   console Copy

   $ sudo ufw allow 443/tcp
   

   Explain Code

   The rule accepts TCP connections on port 443 and blocks UDP traffic to the same port.

3. Allow a port for UDP only, such as the DNS port 53.

   console Copy

   $ sudo ufw allow 53/udp
   

   Explain Code

4. Allow a range of ports by specifying the protocol.

   console Copy

   $ sudo ufw allow 6000:6007/tcp
   

   Explain Code

   UFW requires a protocol when you specify a port range.

5. View the resulting rules.

   console Copy

   $ sudo ufw status
   

   Explain Code

Deny Specific Ports

A deny rule blocks traffic to a port explicitly. With a default incoming policy of deny, an explicit deny rule mainly documents intent or overrides a broader allow rule that appears later in the table.

1. Deny connections to an internal service port such as the MySQL port 3306.

   console Copy

   $ sudo ufw deny 3306
   

   Explain Code

2. Deny a port for a single protocol.

   console Copy

   $ sudo ufw deny 3306/tcp
   

   Explain Code

3. View the rules to confirm the deny entries.

   console Copy

   $ sudo ufw status
   

   Explain Code

   The Action column displays DENY for the blocked ports.

Allow Application Profiles and Named Services

UFW recognizes well-known service names as well as application profiles that packages register when they are installed. A profile groups every port a service needs, so one rule covers all of them instead of several port rules.

1. List the application profiles available on the server. UFW reads them from the /etc/ufw/applications.d directory.

   console Copy

   $ sudo ufw app list
   

   Explain Code

   A server with only OpenSSH installed lists a single profile.

   Available applications:
     OpenSSH

   Note

   A profile exists only after the package that provides it is installed. Rules such as sudo ufw allow 'Nginx Full' fail with ERROR: Could not find a profile matching 'Nginx Full' until Nginx is installed on the server.

2. Inspect the ports a profile covers before applying it.

   console Copy

   $ sudo ufw app info OpenSSH
   

   Explain Code

3. Allow an application profile.

   console Copy

   $ sudo ufw allow OpenSSH
   

   Explain Code

4. Allow a named service such as FTP.

   console Copy

   $ sudo ufw allow ftp
   

   Explain Code

   UFW resolves the name against the /etc/services file and adds a rule for 21/tcp.

Set Up Directional Rules

Directional rules restrict traffic by source address, destination port, or network interface rather than by port alone. Use them to expose a service to a single administrative address instead of the whole internet.

1. Allow SSH from a single source address. Replace 192.0.2.100 with the address you connect from.

   console Copy

   $ sudo ufw allow from 192.0.2.100 to any port 22
   

   Explain Code

   UFW accepts SSH connections from that address and blocks the port for every other source.

2. Allow a source subnet rather than a single address.

   console Copy

   $ sudo ufw allow from 192.0.2.0/24 to any port 22
   

   Explain Code

3. Allow incoming traffic on a specific network interface. Replace enp1s0 with your interface name.

   console Copy

   $ sudo ufw allow in on enp1s0 proto tcp to any port 80
   

   Explain Code

   UFW accepts HTTP connections arriving on that interface and blocks the port on all other interfaces.

4. Allow outgoing traffic on a specific interface.

   console Copy

   $ sudo ufw allow out on enp1s0 proto tcp to any port 443
   

   Explain Code

5. Deny traffic from a specific source address.

   console Copy

   $ sudo ufw deny from 192.0.2.200 to any port 22
   

   Explain Code
   Note

   Each octet of an IPv4 address must be between 0 and 255. UFW rejects an out-of-range value with ERROR: Bad source address.

6. Find your interface names if you do not know them.

   console Copy

   $ ip -br address
   

   Explain Code

Add Comments to Rules

A rule table without comments becomes difficult to audit once it holds more than a few entries. Comments record why a rule exists and appear in the status output alongside the rule.

1. Add a comment to a source-restricted SSH rule.

   console Copy

   $ sudo ufw allow from 192.0.2.100 to any port 22 comment "Admin SSH access"
   

   Explain Code

2. Add a comment to a port rule.

   console Copy

   $ sudo ufw allow 3306/tcp comment "MySQL access for the application server"
   

   Explain Code

3. View the rules with their comments.

   console Copy

   $ sudo ufw status
   

   Explain Code

   The comment appears after a # at the end of each rule.

   Status: active
   
   To                         Action      From
   --                         ------      ----
   3306/tcp                   ALLOW       Anywhere                   # MySQL access for the application server
   3306/tcp (v6)              ALLOW       Anywhere (v6)              # MySQL access for the application server

Delete Rules

UFW deletes rules either by their position in the table or by repeating the rule specification. Deleting by specification is safer, because position numbers change every time a rule is removed.

1. List the rules with their position numbers.

   console Copy

   $ sudo ufw status numbered
   

   Explain Code

   Position numbers appear in brackets at the start of each line. The plain sudo ufw status command does not display them.

   Status: active
   
        To                         Action      From
        --                         ------      ----
   [ 1] 22/tcp                     ALLOW IN    Anywhere
   [ 2] 80                         ALLOW IN    Anywhere
   [ 3] 21/tcp                     ALLOW IN    Anywhere
   [ 4] 22/tcp (v6)                ALLOW IN    Anywhere (v6)
   [ 5] 80 (v6)                    ALLOW IN    Anywhere (v6)
   [ 6] 21/tcp (v6)                ALLOW IN    Anywhere (v6)

2. Delete a rule by its specification. This removes the IPv4 and IPv6 entries together.

   console Copy

   $ sudo ufw delete allow 80
   

   Explain Code

   The output confirms Rule deleted and Rule deleted (v6).

3. Delete a rule by position number when the specification is long.

   console Copy

   $ sudo ufw delete 3
   

   Explain Code

   Enter y when prompted to confirm the deletion.

   Note

   UFW renumbers the remaining rules immediately after each deletion. Run sudo ufw status numbered again before deleting another rule by number, because the number you noted earlier now refers to a different rule.

4. Verify the resulting table.

   console Copy

   $ sudo ufw status numbered
   

   Explain Code

Manage the Firewall

Routine operation involves reloading after manual configuration changes, and occasionally disabling or resetting the firewall during troubleshooting.

1. Reload the firewall after editing files in /etc/ufw directly.

   console Copy

   $ sudo ufw reload
   

   Explain Code

   Rules added with the ufw command apply immediately and do not require a reload.

2. Disable the firewall without removing its rules.

   console Copy

   $ sudo ufw disable
   

   Explain Code

3. Reset the firewall to its default state, removing every rule.

   console Copy

   $ sudo ufw reset
   

   Explain Code

   Enter y when prompted. The command disables the firewall and backs up the previous rules to /etc/ufw.

   Note

   Resetting removes the SSH rule as well. Add it again before re-enabling the firewall on a remote server.

Conclusion

You have enabled UFW, set default policies for incoming and outgoing traffic, created port, service, and directional rules, annotated them with comments, and removed rules safely. Combine UFW with a network-level firewall to filter traffic before it reaches the server, and edit the configuration files in /etc/ufw for advanced rules that run before or after the generated rule set. For more information, see the UFW manual page and the Ubuntu firewall documentation.