Allow SSH with sudo ufw allow OpenSSH, then switch the firewall on with sudo ufw enable. Open other ports only for the services you run.
UFW ("Uncomplicated Firewall") is Ubuntu's standard firewall tool and is switched off on a new installation. The commands are the same on Ubuntu 24.04 LTS and 26.04 LTS. If ufw isn't found, install it with sudo apt install ufw. Don't use UFW on a server with cPanel & WHM and CSF: CSF manages the firewall there (see Install or remove the CSF firewall on a cPanel server).
Switch on the firewall
Connect to the server (see Connect to your server with SSH) and check the current state:
sudo ufw statusA new server shows Status: inactive.
Allow SSH:
sudo ufw allow OpenSSHOpenSSHis a ready-made profile for port 22. If your SSH server listens on another port, allow that port instead, for examplesudo ufw allow 2222/tcp.Allow the services that should be reachable from the internet, for example a web server:
sudo ufw allow 'Nginx Full'For Apache it's
'Apache Full'. Both open ports 80 and 443.Switch on the firewall:
sudo ufw enableUFW warns that the command may disrupt existing SSH connections. Type
yand press Enter. UFW starts at once and again after every reboot.Check the result:
sudo ufw status verboseYou should see Status: active, the default deny (incoming), allow (outgoing), and your rules with ALLOW IN. Open a new SSH session to be sure you can still connect before you close the old one.
Ready-made profiles
Packages such as OpenSSH, Nginx and Apache bring profiles with their ports. List the ones on your server and see which ports a profile opens:
sudo ufw app list
sudo ufw app info 'Nginx Full'| Profile | Ports |
|---|---|
OpenSSH | 22/tcp |
Nginx HTTP / Nginx HTTPS / Nginx Full | 80 / 443 / 80 and 443 |
Apache / Apache Secure / Apache Full | 80 / 443 / 80 and 443 |
A profile only appears once the package that brings it is installed.
Useful rules
| Command | What it does |
|---|---|
sudo ufw allow 8080/tcp | Open a TCP port for everyone |
sudo ufw allow from 203.0.113.25 to any port 3306 proto tcp | Open a port for one IP address only, here MySQL for your office |
sudo ufw allow from 203.0.113.25 | Allow everything from one IP address |
sudo ufw deny from 198.51.100.7 | Block an IP address |
sudo ufw limit OpenSSH | Allow SSH but block an address that opens 6 or more connections within 30 seconds |
sudo ufw status numbered | List the rules with numbers |
sudo ufw delete 3 | Delete rule number 3 from that list |
sudo ufw delete allow 8080/tcp | Delete a rule by repeating it after delete |
sudo ufw insert 1 deny from 198.51.100.7 | Put a rule at the top, so it's checked first |
sudo ufw logging on | Log blocked connections to the system log |
Rules are checked from the top, and the first match decides. That's why a block for an IP address must come before an allow rule for the same port: use insert 1 for it.
Rules for IPv6 are created automatically with each rule, marked (v6) in the list.
Switch it off or start over
sudo ufw disableswitches the firewall off and keeps your rules for next time. sudo ufw reset switches it off and deletes all rules. After a reset, remember to allow SSH again before you enable it.
Common problems
You locked yourself out
Log in through your server's VNC or rescue console. Run sudo ufw allow OpenSSH (or your SSH port), or sudo ufw disable while you fix the rules.
A website or service can't be reached
Run sudo ufw status and check that its port is listed. Then check that the program really listens on that port with sudo ss -tulpn. If the server is at a provider with its own network firewall, that one must allow the port too.
Docker containers are reachable despite UFW
Docker writes its own firewall rules, and ports published with -p bypass UFW's rules. Publish a port only on the local address (for example -p 127.0.0.1:8080:80) and put a web server in front, or follow Docker's documentation on firewalls.
ERROR: Could not find a profile matching 'Nginx Full'
The package that brings the profile isn't installed yet, or the name is written differently. Check the exact names with sudo ufw app list, and keep the quotes around names with a space.
Related articles
- Secure a new Linux server: first 10 steps
- Connect to your server with SSH
- Install the Apache web server on Ubuntu
- Install a LEMP stack (Nginx, MySQL, PHP) on Ubuntu
Still stuck? Open a support ticket and we'll help.
