UFW firewall basics: lock down your VPS

A firewall decides which network connections your server accepts. By default a fresh Linux box may have ports open that you never intended to expose. UFW — the Uncomplicated Firewall — is the friendliest way to fix that on Ubuntu and Debian.

What UFW does

UFW is a simple front-end to the kernel's netfilter system. Instead of writing raw iptables or nftables rules, you say things like "allow SSH" and "deny everything else" in plain commands. Under the hood it builds the real rules for you.

Step 1: Install and check status

UFW ships on Ubuntu; install it if missing:

sudo apt install ufw -y
sudo ufw status verbose

It will report inactive on a fresh system.

Step 2: Allow SSH FIRST

This is the golden rule. If you enable the firewall before allowing SSH, you'll be locked out of your own server. So always start here:

sudo ufw allow OpenSSH

If SSH runs on a custom port, allow that instead:

sudo ufw allow 2222/tcp

Step 3: Set sensible defaults

The safe posture is: block all incoming, permit all outgoing.

sudo ufw default deny incoming
sudo ufw default allow outgoing

Now only the ports you explicitly open will be reachable.

Step 4: Allow web traffic

If you're hosting websites, open HTTP and HTTPS:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

UFW also understands named profiles for common services:

sudo ufw allow 'Nginx Full'

Step 5: Enable the firewall

With SSH allowed, turn it on:

sudo ufw enable

Confirm the prompt. Check your work:

sudo ufw status numbered

You'll see a numbered list of active rules.

Managing rules

Delete a rule by number (from the numbered status output):

sudo ufw delete 3

Or by matching the original rule:

sudo ufw delete allow 80/tcp

Allow a port only from one IP — useful for a database or admin panel you don't want public:

sudo ufw allow from 203.0.113.5 to any port 5432 proto tcp

Rate-limit SSH to slow brute-force attempts (denies an IP after too many connections):

sudo ufw limit OpenSSH

Common ports to remember

• 22 — SSH
• 80 — HTTP
• 443 — HTTPS
• 3306 — MySQL/MariaDB (keep this closed to the public)
• 5432 — PostgreSQL (also keep private)

Databases should almost never be open to the whole internet. Bind them to localhost, or restrict the port to specific IPs as shown above.

If you lock yourself out

It happens. Because Nxeon gives you full root and console access through the dashboard, you can get back in even without SSH and run:

sudo ufw disable

to drop the firewall, fix your rules, and re-enable it. That console safety net is worth knowing about before you start.

The minimal web-server firewall

For a typical site, this is all you need:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable

Four rules and your server only answers on SSH and the web — a huge reduction in attack surface for about a minute of work.