Configure a UFW Firewall on Ubuntu and Debian

Install and set the defaults

UFW ships with Ubuntu and installs on Debian in one command:

sudo apt install -y ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing

Allow SSH before enabling

This is the one step you must not skip. Enabling UFW without an SSH rule drops your session.

sudo ufw limit OpenSSH
sudo ufw enable

limit rather than allow adds rate limiting: an address that opens six or more connections within 30 seconds is blocked temporarily, which blunts brute-force scripts. If you moved SSH to another port, use sudo ufw limit 2222/tcp instead.

Open the services you run

sudo ufw allow 80/tcp       # HTTP
sudo ufw allow 443/tcp      # HTTPS
sudo ufw allow 443/udp      # HTTP/3 (QUIC), if your web server supports it
sudo ufw allow 51820/udp    # WireGuard
sudo ufw allow 25565/tcp    # Minecraft Java edition

Applications that ship UFW profiles can be allowed by name. sudo ufw app list shows what is available, for example Nginx Full or OpenSSH.

Restrict by source address

Databases, admin panels and monitoring agents should rarely be open to the whole internet:

sudo ufw allow from 198.51.100.7 to any port 5432 proto tcp
sudo ufw allow from 10.10.0.0/24 to any port 9100 proto tcp

The first rule lets one office address reach PostgreSQL; the second lets a private subnet scrape a metrics exporter.

Review and remove rules

sudo ufw status numbered
sudo ufw delete 4

Deleting by number is the least error-prone method. Re-run status numbered after each deletion, because the numbers shift.

Logging

sudo ufw logging low
sudo tail -f /var/log/ufw.log

low records blocked packets without flooding the disk. Raise it temporarily to medium when troubleshooting a rule that does not behave as expected.

The Docker caveat

Docker writes its own iptables rules for published ports, and those rules are evaluated before UFW's. A container started with -p 5432:5432 is therefore reachable from the internet even if UFW denies port 5432. Two reliable fixes:

• Publish container ports on localhost only, for example -p 127.0.0.1:5432:5432, and put a reverse proxy in front of anything public.
• Or keep the service off the host network entirely and connect containers over a Docker network.

Our Docker on Ubuntu guide uses the first approach throughout.

Two layers are better than one

The VeloxMedia control panel also lets you manage inbound firewall rules for each server. Those rules drop unwanted traffic before it reaches the VM, while UFW protects you if a rule is changed or a service binds somewhere unexpected. Using both is a sensible belt-and-braces setup.

Recovering from a mistake

If you lock yourself out, open the browser-based VNC console in the control panel, log in, and run sudo ufw disable. Fix the rules, then enable it again.