How to configure the UFW firewall in Ubuntu

If you are just starting out with a VPS or VDS, it is important to think about security right away. One simple and reliable way to limit unwanted connections is to configure a firewall. This guide will show you how to do this with UFW, a lightweight utility for managing network rules on Ubuntu.

What is UFW and why do you need it

UFW stands for Uncomplicated Firewall - that is, “uncomplicated firewall”. It runs on top of Netfilter and supports iptables and nftables. Its main feature is simplicity: everything is configured through the terminal, without the need to poke around in complicated configuration files. This utility is already pre-installed in many versions of Ubuntu, starting with 8.04 LTS.

How to prepare UFW for work

By default, UFW is turned off after installation. This is done on purpose - so that you have time to set the necessary rules and not cut off access to the server. Therefore, you need to open the SSH port before turning it on.

If you have not changed the SSH port, the following command will suffice:

sudo ufw allow OpenSSH

And if the port is non-standard - replace it in the command:

sudo ufw allow 2222/tcp

You can enable the firewall like this:

sudo ufw enable

How to set rules

The general command template is as follows:

sudo ufw [type_action] from [ip] to any port [port_number]

Where [type_action] can be:
→ allow - allow;
→ deny - deny without response;
→ reject - deny with response;
→ limit - limit the frequency of connections (for example, to protect against SSH password mining).

Open ports for popular applications

To see which applications already have templates for UFW, you can do this:

sudo ufw app list

Suppose you want to allow full access to Nginx - run:

sudo ufw allow "Nginx Full"

And if the application runs on port 9000:

sudo ufw allow 9000

Database access

MySQL (port 3306):

Open access to all:

sudo ufw allow 3306

Or to only one IP:

sudo ufw allow from 192.0.2.10 to any port 3306

PostgreSQL (port 5432):

For all:

sudo ufw allow 5432

Only for the desired address:

sudo ufw allow from 192.0.2.10 to any port 5432

HTTP and HTTPS

Open HTTP (port 80):

sudo ufw allow 80

Open HTTPS (port 443):

sudo ufw allow 443

How to delete a rule

First see the list of all rules:

sudo ufw status numbered

To delete, use the number from the list:

sudo ufw delete 4

Or delete the rule directly:

sudo ufw delete from 123. 123.123.123.123 port 35 proto tcp

How to disable UFW

If you temporarily need to disable the firewall, run:

sudo ufw disable

That's it. Now your server is a bit safer. And the best part is that you can do all this in a couple of minutes without being a network security expert.