Security & Hardening
Setting Up UFW Firewall on Ubuntu/Debian
UFW makes iptables management simple. Allow, deny, rate-limit, and audit all traffic on your server.
Published Feb 20, 2025Updated May 30, 20267 min readBeginner
Table of Contents
What is UFW?
UFW (Uncomplicated Firewall) is a front-end for iptables — Linux's built-in packet filter. It gives you a simple command-line interface to manage firewall rules without needing to understand complex iptables syntax.
Check Current Status
ufw status verboseBasic Setup — ALWAYS Do This First
⚠️ Run
ufw allow ssh BEFORE ufw enable or you will permanently lock yourself out of the server via SSH.ufw allow ssh # Allow SSH (port 22)
ufw enable # Turn on the firewall
ufw status # Verify rulesCommon Port Rules
ufw allow 80/tcp # HTTP web traffic
ufw allow 443/tcp # HTTPS web traffic
ufw allow 3306/tcp # MySQL (only if external access needed)
ufw allow 5432/tcp # PostgreSQL (only if external)
ufw allow 6379/tcp # Redis
ufw allow 25565/tcp # Minecraft Java
ufw allow 19132/udp # Minecraft Bedrock
ufw allow 27015/tcp # CS2 / Source Engine games
ufw allow 2222/tcp # SSH on custom portAllow Access from Specific IP Only
# Only allow MySQL from your office IP
ufw allow from 203.0.113.10 to any port 3306
# Only allow SSH from your home IP
ufw allow from 203.0.113.10 to any port 22Block a Specific IP
ufw deny from 1.2.3.4
ufw deny from 1.2.3.0/24 # Block an entire subnetRate Limit SSH (Brute-Force Protection)
ufw limit sshBlocks any IP making more than 6 connection attempts in 30 seconds. A lightweight alternative to fail2ban for SSH protection.
Delete a Rule
ufw status numbered # Show rules with numbers
ufw delete 3 # Delete rule #3Reset All Rules
ufw reset # Wipe all rules (disables firewall too)
ufw --force reset # Skip confirmation promptView Firewall Logs
ufw logging on
tail -f /var/log/ufw.logUFWFirewallSecurityLinux
Was this article helpful?
