How to Set Up and Configure UFW Firewall on Ubuntu Server

Securing your Linux Virtual Private Server (VPS) begins with controlling network traffic entering and leaving your system. UFW (Uncomplicated Firewall) is the default firewall configuration interface in Ubuntu. Designed to provide a user-friendly abstraction layer over the powerful Linux iptables / nftables subsystem, UFW enables you to create and manage enterprise-grade firewall rules with simple, memorable commands.

Whether you are running Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, or Ubuntu 20.04 LTS, configuring UFW is a crucial first line of defense to block unauthorized port scans, malicious bots, and unwanted network connections on your Aveshost VPS.

In this step-by-step guide, you will learn how to check UFW status, configure default policies, allow essential services (SSH, HTTP, HTTPS), open specific port ranges, delete rules, and safely enable the firewall without getting locked out.

Prerequisites

• An active Linux VPS running Ubuntu (26.04, 24.04, 22.04, or 20.04 LTS).
• SSH access with sudo or root privileges (see How to Log in and Access Ubuntu Server via SSH).

Step-by-Step Guide: How to Configure UFW Firewall on Ubuntu

Step 1: Check UFW Installation and Status

By default, UFW is pre-installed on Ubuntu but remains disabled until explicitly activated. Check the current status:

sudo ufw status

If disabled, it will display: Status: inactive.

Step 2: Set Up Default Firewall Policies

A secure firewall policy denies all incoming traffic by default while allowing all outgoing traffic. This ensures that only services you explicitly whitelist can be reached from the Internet:

sudo ufw default deny incoming
sudo ufw default allow outgoing

Step 3: Allow SSH Connections (CRITICAL STEP)

1. If you are using the default SSH port (22), allow the OpenSSH profile or port 22:

   sudo ufw allow OpenSSH
   # OR explicitly:
   sudo ufw allow 22/tcp

2. If your server uses a custom SSH port (e.g. 2222), allow that specific port instead:

   sudo ufw allow 2222/tcp

Step 4: Allow Web Traffic (HTTP and HTTPS)

If you are hosting websites, web applications, or APIs on Nginx or Apache, allow web traffic:

# For Nginx:
sudo ufw allow 'Nginx Full'

# For Apache:
sudo ufw allow 'Apache Full'

# OR allow standard HTTP & HTTPS ports directly:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Step 5: Allow Other Common Services & Ports (Optional)

Depending on your application stack, you may wish to allow additional ports:

• Node.js / Express Web App (Port 3000):

  sudo ufw allow 3000/tcp

• Port Range (e.g., Passive FTP ports 60000-65000):

  sudo ufw allow 60000:65000/tcp

• Allowing a Specific IP Address (e.g., MySQL / PostgreSQL remote access only for your office IP):

  sudo ufw allow from 203.0.113.50 to any port 3306 proto tcp

Step 6: Enable UFW Firewall

1. Once your SSH and web rules are added, enable UFW:

   sudo ufw enable

2. When prompted with "Command may disrupt existing ssh connections. Proceed with operation (y|n)?", type y and press ENTER.

Step 7: Verify Detailed Firewall Status and Rules

Check the numbered list of active firewall rules:

sudo ufw status verbose
# OR check numbered list:
sudo ufw status numbered

You will see a clean summary of allowed rules and protocols:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 2] Nginx Full                 ALLOW IN    Anywhere
[ 3] 22/tcp (v6)                ALLOW IN    Anywhere (v6)
[ 4] Nginx Full (v6)            ALLOW IN    Anywhere (v6)

How to Delete or Reset UFW Rules

Deleting a Rule by Number

1. List the numbered rules: sudo ufw status numbered
2. Delete the specific rule index (e.g. rule #3):

   sudo ufw delete 3

Disabling or Resetting UFW

• To temporarily disable the firewall: sudo ufw disable
• To reset UFW to factory defaults (removes all custom rules): sudo ufw reset

Frequently Asked Questions & Troubleshooting

Q: What should I do if I accidentally locked myself out of my VPS?
A: Log in to the Aveshost Client Area, open your VPS management dashboard, and launch the VNC / Web Console. This gives you direct out-of-band keyboard access to your server to run sudo ufw allow 22/tcp or sudo ufw disable.

Q: Does UFW block outgoing connections from my server?
A: No. With default allow outgoing configured, your server can freely download updates, connect to external APIs, and make outbound requests.

Need Further Assistance?

If you have questions about configuring UFW firewall rules, managing open ports, or securing network services on your Ubuntu VPS, our technical support team is available 24/7. Feel free to submit a support ticket through your client area for expert assistance.