UFW Firewall Ubuntu: Complete Setup Guide

by

UFW — Uncomplicated Firewall — is the simplest way to control network traffic on Ubuntu, and it is powerful enough for production servers. This UFW firewall Ubuntu guide covers everything from first install to advanced rules, including the exact port setup mail servers need. By the end, your server will accept only the traffic you explicitly allow.

What Is UFW and Why Use It?

UFW is a friendly frontend for iptables/nftables, Ubuntu's built-in packet filtering. Raw iptables rules are cryptic; UFW lets you write ufw allow 443 instead. It ships installed (but disabled) on most Ubuntu server images, persists rules across reboots, supports IPv6 and application profiles, and plays nicely with Docker and mail servers. For a single-server UFW firewall Ubuntu setup, it is all you will ever need.

UFW Firewall Ubuntu: Installation and First Rules

Step 1: Install and Check Status

apt install ufw -y
ufw status verbose

A fresh install shows Status: inactive. Never enable UFW before allowing SSH — you will lock yourself out.

Step 2: Set Default Policies

ufw default deny incoming
ufw default allow outgoing

This is the security posture you want: the server can reach out (updates, DNS, API calls), but nothing unsolicited gets in.

Step 3: Allow SSH First

ufw allow OpenSSH
# or, if you moved SSH to a custom port:
ufw allow 2222/tcp

Step 4: Enable the Firewall

ufw enable

Confirm with ufw status numbered. Your basic UFW firewall Ubuntu setup is now live.

Essential UFW Rules for Common Services

  • Web server: ufw allow 80,443/tcp
  • Mail server (submission): ufw allow 25,587,465/tcp and ufw allow 143,993,110,995/tcp for IMAP/POP3
  • DNS server: ufw allow 53 (covers TCP and UDP)
  • Specific IP only: ufw allow from 203.0.113.10 to any port 3306 — ideal for locking MySQL to your app server
  • Subnet: ufw allow from 192.168.1.0/24
  • Delete a rule: ufw delete allow 8080 or by number: ufw delete 3

UFW Application Profiles

Many packages register named profiles so you do not have to remember ports. List them with ufw app list and inspect one with ufw app info 'Nginx Full'. Allowing a profile — ufw allow 'Nginx Full' — opens exactly the ports that application needs and nothing more.

Rate Limiting and Logging

UFW's built-in rate limiting is a lightweight anti-brute-force tool:

ufw limit ssh

This denies connections from an IP that attempts six or more SSH connections within 30 seconds. For visibility, turn on logging with ufw logging on — blocked packets land in /var/log/ufw.log, which pairs perfectly with fail2ban for automatic banning.

Troubleshooting Common UFW Problems

Even a simple tool trips people up. Here are the fixes for the three most common UFW firewall Ubuntu headaches:

  • Locked out of SSH: use your host's web console (OVH, Contabo, and Hetzner all provide one) to log in locally, then run ufw allow 22 and ufw reload. Keep a console tab open whenever you change firewall rules remotely.
  • Rule order conflicts: UFW evaluates rules top-down and the first match wins. If an allow rule seems ignored, check ufw status numbered — a deny rule above it may be shadowing it. Delete and re-add the rules in the right order.
  • Docker bypassing UFW: Docker inserts its own iptables rules that can bypass UFW policies. Bind container ports to localhost with -p 127.0.0.1:8080:80 or use the community ufw-docker utility to keep UFW in charge.

UFW Cheat Sheet

Bookmark these commands — they cover 95% of daily UFW firewall Ubuntu work:

  • ufw status verbose — show rules, logging, and default policies
  • ufw allow 443/tcp — open a port
  • ufw deny from 203.0.113.5 — block an IP entirely
  • ufw delete allow 8080 — remove a rule by specification
  • ufw reload — re-apply rules after manual edits
  • ufw reset — wipe all rules and start over (disables the firewall)
  • ufw logging low — control log verbosity (off/low/medium/high/full)

UFW and Port 25 for Email Servers

Mail servers need special care in any UFW firewall Ubuntu configuration. Open ports 25 (SMTP), 587 (submission), and 465 (SMTPS) only if the server actually sends or receives mail. If your provider blocks port 25 at the network level — as many do by default — no firewall rule can override that; check our provider roundup linked below, or host with an email-friendly provider like Contabo. Always restrict port 25 to authenticated use and never open a relay to the world.

Key Takeaways

  • A UFW firewall Ubuntu setup follows a simple pattern: deny incoming by default, allow outgoing, then open only the ports you need.
  • Always allow SSH before running ufw enable — this is the number-one cause of self-inflicted lockouts.
  • Use application profiles and ufw limit to keep rules readable and brute-force attempts throttled.
  • Enable logging and pair UFW with fail2ban for an active defense layer.
  • Mail servers need ports 25/587/465 open, but confirm your host allows port 25 first — the firewall cannot bypass a provider block.

Related Guides

Leave a Comment