VPS Security Guide

UFW Firewall Guide: Set Up a Firewall on Ubuntu VPS — Complete 2026

By CloudPicked Review Team · Updated October 2026 · 12 min read

When you spin up a new VPS on DigitalOcean, Bangmod Cloud, or any other provider, your server is exposed to all ports by default — and malicious bots are actively scanning for open ports within minutes of launch.

UFW (Uncomplicated Firewall) is Ubuntu's default firewall tool, designed to make iptables configuration accessible without requiring deep networking knowledge. This guide walks you through a complete, production-ready UFW setup from scratch.

What Is UFW and How It Works

UFW stands for Uncomplicated Firewall, developed by the Ubuntu team to simplify iptables management. The goal is to let everyday users configure a firewall without memorising iptables chains, tables, and rule syntax.

According to the official Ubuntu Wiki: UFW provides a "user-friendly way to create an IPv4 or IPv6 host-based firewall" and is disabled by default on all Ubuntu versions.

UFW vs iptables

UFW does not replace iptables — it is a frontend that writes iptables rules automatically. When you run sudo ufw allow 80, UFW translates this into the correct iptables rule behind the scenes.

Installing and Enabling UFW

On Ubuntu 20.04 / 22.04 / 24.04, UFW comes pre-installed. To install it freshly:

sudo apt update
sudo apt install ufw -y

Before enabling UFW, you must allow SSH first:

# Option 1: Allow SSH by service name (recommended)
sudo ufw allow ssh

# Option 2: Allow port 22 directly
sudo ufw allow 22/tcp

# Option 3: If you changed the SSH port (e.g. 2222)
sudo ufw allow 2222/tcp

Then enable UFW:

sudo ufw enable
# Type y to confirm

Check the status:

sudo ufw status verbose

Expected output:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)

Essential UFW Commands

Check Status

# General status
sudo ufw status

# Detailed status with default policy
sudo ufw status verbose

# Status with rule numbers (useful for deleting specific rules)
sudo ufw status numbered

Allow and Deny

# Allow a port
sudo ufw allow <port>
sudo ufw allow <port>/tcp
sudo ufw allow <port>/udp

# Allow a port range
sudo ufw allow 8000:8080/tcp

# Deny a port
sudo ufw deny <port>
sudo ufw deny <port>/tcp

Delete Rules

# Method 1: Delete by specifying the original rule
sudo ufw delete allow 80/tcp

# Method 2: Delete by rule number (from ufw status numbered)
sudo ufw delete 3

Reset and Disable

# Temporarily disable UFW
sudo ufw disable

# Reset — removes all rules and returns to defaults
sudo ufw reset

Firewall Rules for Web Servers

For a VPS running Nginx or Apache as a web server, open these ports:

# HTTP
sudo ufw allow 80/tcp

# HTTPS
sudo ufw allow 443/tcp

# Or use Application Profiles (if nginx/apache is installed)
sudo ufw allow 'Nginx Full'
sudo ufw allow 'Apache Full'

Database Server Rules

# MySQL/MariaDB — allow only trusted IP
sudo ufw allow from 192.168.1.100 to any port 3306

# PostgreSQL — allow only internal subnet
sudo ufw allow from 10.0.0.0/8 to any port 5432

# Redis — never open to public
sudo ufw deny 6379

Complete Ruleset for a LAMP/LEMP Stack

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Protecting SSH with UFW

Port 22 is the primary target for brute force attacks — bots scan it 24/7. UFW offers several ways to harden SSH access:

1. Allow SSH from Trusted IPs Only

# Allow only your specific IP
sudo ufw allow from 203.0.113.5 to any port 22 proto tcp

# Allow an entire office subnet
sudo ufw allow from 203.0.113.0/24 to any port 22 proto tcp

2. Change the SSH Port

A common hardening step is moving SSH from port 22 to a non-standard port (e.g. 2222):

# In /etc/ssh/sshd_config — change Port 22 to Port 2222
# Then:
sudo ufw allow 2222/tcp
sudo ufw deny 22/tcp    # Only after successfully reconnecting on the new port
sudo systemctl restart sshd

UFW Rate Limiting

UFW has built-in rate limiting — it blocks IPs that make more than 6 connection attempts within 30 seconds. This is extremely effective against SSH brute force attacks:

sudo ufw limit ssh
# Or by port number
sudo ufw limit 22/tcp

With limit active, UFW drops connections from IPs exceeding the threshold while still allowing normal traffic from other IPs.

Application Profiles

Some installed applications register profiles with UFW automatically, making it easy to allow them by name:

# List available profiles
sudo ufw app list

# Example output:
# Available applications:
#   Apache
#   Apache Full
#   Apache Secure
#   Nginx Full
#   Nginx HTTP
#   Nginx HTTPS
#   OpenSSH

# Allow by profile name
sudo ufw allow 'Nginx Full'     # Opens both HTTP and HTTPS
sudo ufw allow 'Nginx HTTPS'    # Opens HTTPS only
sudo ufw allow 'OpenSSH'        # Opens SSH

# Show profile details
sudo ufw app info 'Nginx Full'

Logging Configuration

UFW logging helps you track which traffic is being blocked. According to the Ubuntu docs, the logging levels are:

# Enable logging (default = low)
sudo ufw logging on

# Set a specific level
sudo ufw logging medium

# Disable logging
sudo ufw logging off

Logs are written to /var/log/ufw.log — monitor in real-time with:

sudo tail -f /var/log/ufw.log

Advanced Rules and Rule Management

Allow/Deny by IP Address

# Allow a single IP (all ports)
sudo ufw allow from 203.0.113.5

# Allow a single IP on a specific port
sudo ufw allow from 203.0.113.5 to any port 3306

# Block an IP or subnet
sudo ufw deny from 198.51.100.0/24

Allow by Network Interface

# Allow traffic on eth0 to port 80 only
sudo ufw allow in on eth0 to any port 80

Insert Rules at a Specific Position

# View current rules with numbers
sudo ufw status numbered

# Insert at position 1 (highest priority)
sudo ufw insert 1 allow from 203.0.113.5 to any port 22

IPv6 Support

Verify that IPv6 is enabled in your UFW config:

sudo nano /etc/default/ufw
# Ensure the following line is present:
# IPV6=yes

Production Best Practices

1. Principle of Least Privilege

Only open the ports your services actively require. Every additional open port expands your attack surface.

2. Layer UFW with Your Cloud Firewall

Providers like Bangmod Cloud and DigitalOcean offer cloud-level firewalls that block traffic before it reaches your server. Use both — cloud firewall as the outer perimeter, UFW as the host-based inner layer. This is defense-in-depth.

3. Back Up Rules Before Resetting

sudo cp /etc/ufw/user.rules /etc/ufw/user.rules.backup
sudo cp /etc/ufw/user6.rules /etc/ufw/user6.rules.backup

4. Test on Staging First

Always test firewall rule changes on a staging server before applying to production. Keep console or KVM access open as a failsafe in case you lock yourself out.

5. Recommended Ruleset for a WordPress/General VPS

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw limit ssh           # SSH with rate limiting
sudo ufw allow 80/tcp        # HTTP
sudo ufw allow 443/tcp       # HTTPS
sudo ufw deny 3306/tcp       # Block MySQL from public
sudo ufw deny 6379/tcp       # Block Redis from public
sudo ufw enable

Summary: UFW Is Your VPS Security Foundation

UFW takes less than 5 minutes to configure but provides substantial protection against brute force attacks and unauthorized access. The immediate steps after launching any new VPS:

1. Allow SSH first
2. Enable UFW
3. Allow required ports (80, 443)
4. Enable ufw limit ssh for brute force protection
5. Verify with sudo ufw status verbose

FAQ — Frequently Asked Questions About UFW Firewall