Configuring the UFW firewall on Ubuntu

Why is the UFW Firewall Important on Ubuntu?

When you first spin up an Ubuntu server, all ports are open by default. This means anyone on the internet can connect to services running on your server; from SSH to MySQL and web servers. This situation is practically an invitation for automated scanners and brute-force attacks. UFW firewall (short for Uncomplicated Firewall) is a tool designed precisely for this problem: a simple command-line interface on top of iptables that lets you control incoming traffic with a few short commands.

In this article, you will learn how to enable the UFW firewall on Ubuntu, open the necessary ports, and most importantly, avoid the common mistake that causes you to lose your SSH access. This guide is valid for Ubuntu 20.04 and newer versions.

Installing and Initial Activation of UFW Firewall

In most Ubuntu installations, UFW is already installed. If it's not, install it with this command:

sudo apt update
sudo apt install ufw

Before doing anything, check the current firewall status:

sudo ufw status verbose

The output is usually Status: inactive. Now it's time to set the initial rules. But here's a serious warning: if you run the sudo ufw enable command right now, you will most likely lose your SSH access, because the default policy is to deny all incoming traffic. So, set up the rules first, then enable the firewall.

Setting the Default Policy

The default policy determines what happens if there is no explicit rule for a connection. The best and most secure setup is:

sudo ufw default deny incoming
sudo ufw default allow outgoing

This means all incoming traffic is blocked unless you have explicitly allowed it, and all outgoing traffic (like updates and DNS responses) is free. This policy is the foundation of a secure server.

Opening Essential Ports Before Activation

Now you need to open the ports you actually need. Do this before enabling the firewall to reduce the risk of disconnection to zero.

Opening the SSH Port (The Most Important Rule)

If you have SSH on the standard port 22:

sudo ufw allow ssh

If you have changed the SSH port (for example, to 2222), you must specify the port explicitly:

sudo ufw allow 2222/tcp

Note that allow ssh is equivalent to allow 22/tcp. If you have a non-standard port, be sure to specify the protocol as well. This prevents accidentally opening the UDP port.

Opening Web Ports and Common Services

For a web server (HTTP and HTTPS):

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

For MySQL or MariaDB if you connect remotely (only from your IP, not from everywhere):

sudo ufw allow from 203.0.113.10 to any port 3306/tcp

This rule only allows the specified IP to connect to MySQL. This is a much better approach than opening the port to everyone. Do the same for DNS, SMTP, and other services:

sudo ufw allow 53/tcp
sudo ufw allow 53/udp
sudo ufw allow 25/tcp

Opening a Port for a Game or Specific Application

If you have a game or application that works over UDP (like some online games), be sure to specify the protocol:

sudo ufw allow 27015/udp

Enabling the Firewall and Checking Rules

After you have opened all the necessary ports, now you can enable the firewall:

sudo ufw enable

The system will ask for confirmation and warn you that this may disrupt SSH. Since you have already added the SSH rule, you can safely press y. After enabling, check the status:

sudo ufw status verbose

The output should look something like this:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere
3306/tcp                   ALLOW IN    203.0.113.10

Managing Rules: Adding, Deleting, and Modifying

Throughout the life of your server, you will always need to change rules. Remember this section.

Deleting a Rule

There are two ways to delete a rule. The first is by rule number. First, view the numbers:

sudo ufw status numbered

The output will show a number at the beginning of each line. Then delete:

sudo ufw delete 3

The second method is deleting by the rule itself:

sudo ufw delete allow 80/tcp

Modifying a Rule

UFW does not edit rules; you must delete and re-add them. For example, to change the allowed IP in the MySQL rule:

sudo ufw delete allow from 203.0.113.10 to any port 3306/tcp
sudo ufw allow from 198.51.100.20 to any port 3306/tcp

Opening a Port Range

To open a range of ports (for example, 8000 to 8100):

sudo ufw allow 8000:8100/tcp

Common Mistake: Getting Locked Out of the Server and How to Recover

The most common mistake beginners make is enabling the firewall before adding the SSH rule, or writing the SSH rule incorrectly (for example, opening the port with the wrong protocol). The result: SSH access is cut off, and you are locked out of the server.

If this happens, you have a few recovery options:

1. Console access via the management panel: If your server is in a data center or hosting company like ServerNet, you usually have a web-based console (like noVNC or IPMI). Log in from there and run the command sudo ufw disable.
2. Restart with network settings: If you don't have a console, restart the server from the management panel. UFW remains active after a restart by default, so this method usually doesn't work unless you have a rule to reset the firewall at boot.
3. Create a fail-safe rule before enabling: This is the best approach. Add a rule that automatically disables the firewall after 5 minutes. If everything is fine, remove this rule:

sudo sh -c "echo 'sudo ufw disable' | at now + 5 minutes"

This command uses the at tool. If it's not installed, install it with sudo apt install at. After enabling the firewall, if SSH is working, remove this scheduled rule with sudo atrm $(atq | awk '{print $1}').

Testing Rules Without Disrupting the Current Connection

Another smart method: before applying rules to the main firewall, open a second SSH session and keep it open. If the first session drops, use the second session to fix the issue. This is an unwritten rule among server administrators.

Logging and Troubleshooting

UFW logs by default. To view the logs:

sudo tail -f /var/log/ufw.log

This log shows you which packets have been blocked. If a service is not accessible from outside, check this log first. You will usually see that a packet from the desired IP to the desired port has been BLOCKed. This means your rule is wrong or doesn't exist at all.

To test connectivity from outside, you can use tools like nc (netcat):

nc -zv your-server-ip 443

If the port is open, you will see a succeeded message. If it's closed, you will get Connection refused or a timeout.

Summary and Final Tips

Configuring the UFW firewall on Ubuntu is not difficult, but it requires attention. Here's a summary of the golden rules:

• Always add the SSH rule before enabling the firewall.
• Use the default policy of deny incoming and allow outgoing.
• Only open the ports you actually need.
• For sensitive services like MySQL, restrict access to a specific IP.
• Always keep a second SSH session open.
• Check the logs to understand what is being blocked.

By following these tips, the UFW firewall will become a reliable shield for your Ubuntu server, and you won't have to worry about getting locked out. If your server is hosted on cloud or dedicated infrastructure, be sure to be aware of your management panel's console tool; this tool is a lifesaver in emergency situations.