💡

Before you start

You need a Linux machine where you can use sudo, and you should not practise on a server anyone depends on. The commands here change real system state. A spare machine, a virtual machine, or a cloud instance you can rebuild is the right place; a laptop you own is fine too. If the terminal itself is new to you, do Introduction to the Linux Terminal first — it takes about ten minutes and everything below assumes it. Every step tells you how to undo it.

What is UFW?

UFW (Uncomplicated Firewall) is a user-friendly front-end for managing iptables firewall rules on Linux. It comes pre-installed on Ubuntu and is designed to make firewall management accessible without needing to understand complex iptables syntax.

A firewall controls which network traffic is allowed into and out of your computer. Without one, any service running on your system could be accessible to the entire network.

💡

Is UFW installed?

UFW comes pre-installed on Ubuntu and Linux Mint. On other distributions, install it with your package manager (e.g., sudo apt install ufw).

Checking UFW Status

Before making changes, check whether UFW is currently active:

sudo ufw status

If UFW has never been enabled, you will see:

Status: inactive

For more detail on existing rules, use the verbose flag:

sudo ufw status verbose

To see rules with reference numbers (useful for deleting specific rules):

sudo ufw status numbered

Enabling and Disabling UFW

⚠️

SSH users: Allow SSH before enabling!

If you are connected via SSH, run sudo ufw allow ssh BEFORE enabling the firewall. Otherwise, you will be locked out of your own server.

Enable UFW to start filtering traffic:

sudo ufw enable

UFW will warn that this may disrupt existing SSH connections. Type y to confirm.

To disable UFW and stop all filtering:

sudo ufw disable

To reset UFW to factory defaults (removes all rules):

sudo ufw reset

Setting Default Policies

Default policies determine what happens to traffic that does not match any specific rule. The recommended security configuration is to deny all incoming traffic and allow all outgoing:

sudo ufw default deny incoming
sudo ufw default allow outgoing

This means:

Incoming traffic is blocked unless you create a rule to allow it
Outgoing traffic is allowed so your applications can reach the internet

Allowing and Denying Traffic

Allow by Service Name

UFW knows common services by name:

sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https

Allow by Port Number

sudo ufw allow 8080
sudo ufw allow 3306/tcp

Allow a Port Range

sudo ufw allow 6000:6007/tcp

Allow from a Specific IP

sudo ufw allow from 192.168.1.100

Allow from a Subnet to a Specific Port

sudo ufw allow from 192.168.1.0/24 to any port 22

Deny Traffic

sudo ufw deny 23
sudo ufw deny from 203.0.113.50

Deleting Rules

First, list rules with numbers:

sudo ufw status numbered

Example output:

Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 2] 80/tcp                     ALLOW IN    Anywhere
[ 3] 443/tcp                    ALLOW IN    Anywhere

Delete a rule by its number:

sudo ufw delete 2

Or delete by specifying the rule itself:

sudo ufw delete allow 80/tcp

Now Do It Yourself: Five Steps

A firewall you enable carelessly on a remote machine locks you out of it permanently. The order of these steps is the whole point: you allow your way in before you close the door. Step 5 opens the lid and shows what ufw actually builds underneath, which is the part that turns it from a magic word into something you can reason about.

Find out what is running before you change anything

Go: open a terminal on the machine you are securing. If that machine is remote, read step 3 before you type anything at all.

Do: run sudo ufw status verbose.

You should see: either Status: inactive, or an active policy with its rules listed. Knowing which you started from is what lets you put things back.

If not: ufw: command not found means it is not installed — sudo apt install ufw on Debian and Ubuntu. Installing it does not enable it, so nothing changes until step 4. Red Hat-family systems use firewalld instead, with different commands but the same order of operations.

Set the default posture — still without enabling anything

Go: same terminal.

Do: run these two commands.

sudo ufw default deny incoming
sudo ufw default allow outgoing

You should see: each confirming the default policy was updated. Nothing is enforced yet — these are the rules that will apply to anything your later rules do not mention. Deny inbound, allow outbound is the correct starting posture for essentially every server and desktop.

If not: if you are tempted to set deny outgoing as well, understand what it costs first: every update, every DNS lookup and every package install stops until you write rules for them. It is a legitimate choice for a locked-down server and a miserable one for a workstation.

🔴 Allow your own way in — BEFORE enabling

Go: same terminal. This is the step people skip, once.

Do: if you reach this machine over SSH, run sudo ufw allow 22/tcp now. If sshd listens on a different port, allow that number instead. Then run sudo ufw show added to read back what you have queued.

You should see: your SSH rule listed among the rules to be added. Confirm the port is the one you are actually connected on — check with sudo ss -tlnp | grep sshd rather than assuming 22.

If not: 🔴 Enabling a default-deny firewall on a remote machine without this rule ends your session and every future one. There is no undo over the network, because the network is what you just closed. Recovery means a console through your hosting provider, or physical access. If you have any doubt, allow SSH twice rather than once.

Enable it, then prove you are still reachable

Go: same terminal — and if this is remote, leave it open.

Do: run sudo ufw enable. It warns that this may disrupt existing connections; answer y. Then run sudo ufw status numbered. Finally, from a second terminal, open a fresh SSH session to the same machine.

You should see: the firewall reporting it is active and enabled at boot, a numbered list of rules, and a successful new login from the second terminal. That fresh login is the real test — your existing session survives on an established connection and proves nothing about whether new ones can get in.

If not: if the second login hangs, do not close the first. Use it to run sudo ufw disable, then work out what is missing before trying again. ⚠️ The exact wording of these ufw messages was not captured while writing this page — ufw cannot run in the isolated sandbox this was verified in, because it inspects the ownership of the root directory itself. The commands and their order are the standard ones; the outputs in step 5 below, however, are real.

Look underneath: ufw is a front end, and this is the engine

Go: same terminal. Everything below was executed and captured for real.

Do: build the same policy directly, so you can see its shape.

sudo iptables -P INPUT DROP
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -L INPUT -n --line-numbers

You should see: Chain INPUT (policy DROP) and three numbered rules — the conntrack one first, then loopback, then port 22. That order is not decoration: rules are read top to bottom and the first match wins. The ESTABLISHED,RELATED rule sits first because it lets replies to your own outbound traffic back in, and without it a default-deny policy breaks web browsing and DNS.

If not: iptables: Index of deletion too big. appears if you try iptables -D INPUT 4 when only three rules exist — numbering starts at 1 and shifts every time you delete one, so always re-run the listing between deletions. In ufw the same job is sudo ufw status numbered then sudo ufw delete 3, with exactly the same renumbering trap.

🎉

Check yourself before moving on

Without scrolling up: you enable a default-deny firewall on a remote server and your SSH session keeps working. Are you safe to close it? Answer: no. An established connection survives the policy change; it says nothing about new ones. Open a second session first and confirm a fresh login succeeds.

Now do it without the page: work out which rule in step 5 would break ordinary web browsing if you removed it, and why the answer is not the port-22 one. Then write the ufw equivalent of allowing HTTPS inbound from a single address. The first question is the one that teaches how stateful firewalls actually work.

Summary

In this tutorial, you learned:

What UFW is and how to check its status
How to enable and disable the firewall safely
Setting default policies for incoming and outgoing traffic
Allowing and denying traffic by service, port, IP, and subnet
How to delete rules you no longer need

🎉

Your system is now protected!

With UFW enabled and configured, your Linux system has a solid first line of defense against unauthorized network access.

UFW Firewall Basics