Skip to main content
ufw is a simple layer on top of iptables: short commands instead of long rules. The idea: block all incoming traffic and open only the ports you need, such as SSH and your site.

​
Installation

Connect over SSH as root: Connection. On Ubuntu ufw is usually already installed, if not:

​
Enabling

Allow SSH before ufw enable, otherwise you lose access to the server. If that happens, log in through Console on the server card, not every server has it.
  1. SSH – the ready-made OpenSSH profile opens port 22:
    SSH on a custom port – open that number, for example ufw allow 2222/tcp.
  2. Policies – incoming blocked, outgoing open, so the server can fetch updates and reach the network on its own:
  3. Start – answer y at the prompt:

​
Site ports

A web server needs 80 (HTTP) and 443 (HTTPS):
Open only what you use. A database, for example, usually has no reason to face the outside: let it listen locally only.

​
Rules

  • ufw status – current rules.
  • ufw status numbered – rules with numbers, needed for deletion.
  • ufw delete allow 80 – delete a rule by its text.
  • ufw delete 3 – delete a rule by its number.
Next: Server hardening, SSH keys.