How to Set Up a Firewall on Your VPS with UFW

A fresh VPS ships with every port open. Within hours of going online, bots will start probing SSH, MySQL, Redis — anything that answers. UFW (Uncomplicated Firewall) is the fastest way to close that gap on Ubuntu and Debian. Setup takes about five minutes. Here is the exact sequence, including the one mistake that locks you out of your own server.

Install and check status

Ubuntu usually has UFW preinstalled. Check first:

sudo ufw status
# if not installed:
sudo apt update && sudo apt install ufw -y

Status will say inactive. Good — don’t enable it yet.

Allow SSH before anything else

This is the step people skip and regret. If you enable UFW with default deny rules and no SSH exception, your current session survives but the next connection attempt gets dropped. You’ll need the provider’s web console to recover.

sudo ufw allow 22/tcp

Running SSH on a custom port? Allow that port instead. Check what sshd actually uses with grep Port /etc/ssh/sshd_config — don’t guess.

Set default policies and open your service ports

The standard baseline: block everything inbound, allow everything outbound.

sudo ufw default deny incoming
sudo ufw default allow outgoing

Then open only what your server actually serves. For a typical web server:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

What you should NOT open to the world: 3306 (MySQL), 6379 (Redis), 27017 (MongoDB). If an app on another server needs your database, allow that single IP instead:

sudo ufw allow from 203.0.113.50 to any port 3306

Enable and verify

sudo ufw enable
sudo ufw status verbose

It warns that enabling may disrupt existing connections — you already allowed 22, so type y. Before closing your current terminal, open a second SSH session to confirm you can still get in. Keep the first one alive until the second connects.

To verify from outside, scan your server from another machine: nmap -F your-server-ip. Only the ports you allowed should show as open.

Rules you’ll need later

# list rules with numbers
sudo ufw status numbered
# delete rule number 3
sudo ufw delete 3
# rate-limit SSH (blocks IPs making 6+ connections in 30 seconds)
sudo ufw limit 22/tcp

The limit rule is worth setting on day one. It cuts brute-force noise dramatically without any extra software, and it pairs well with Fail2ban if you want harder enforcement.

FAQ

I enabled UFW and locked myself out. Now what?
Log in through your VPS provider’s web console (VNC/serial), then run sudo ufw allow 22/tcp or sudo ufw disable and fix your rules.

Does UFW work with Docker?
Partially. Docker writes its own iptables rules and published ports bypass UFW by default. Either bind containers to 127.0.0.1 (-p 127.0.0.1:8080:80) or look into the DOCKER-USER chain.

UFW or a cloud provider firewall — which one?
Use both. The cloud firewall stops traffic before it reaches your VPS; UFW protects you if that config changes or if you migrate providers.

Got a port setup you’re not sure about? Drop a comment on fenij.com with your ufw status output and I’ll take a look.