Linux · Firewall · Security · Networking

UFW Firewall
Cheatsheet

A complete reference for UFW (Uncomplicated Firewall) — the simplified iptables frontend for Ubuntu/Debian systems, covering enable/disable, allow/deny rules, port rules, application profiles, and logging.

Tool: UFW

Backend: iptables / nftables

Distro: Ubuntu / Debian

Sections: 7

Debian UFW Wiki

What is UFW?

UFW (Uncomplicated Firewall) is a simplified frontend for managing iptables firewall rules on Ubuntu and Debian-based Linux systems. Introduced in Ubuntu 8.04, it was designed to make firewall management accessible without deep knowledge of iptables syntax.

What it does: UFW controls incoming and outgoing network traffic by defining rules that allow or deny connections based on port, protocol, and IP address. It is the default firewall management tool on Ubuntu servers.

Real-world use: Securing Linux servers — blocking unwanted ports, restricting SSH access to specific IPs, allowing only HTTP/HTTPS traffic, and protecting databases from external access. Essential for any internet-facing Linux server.

Protect Linux servers

Block unwanted ports

Restrict SSH access

Mitigate attack surface

⚠️ Important: Always allow SSH (port 22) before enabling UFW on a remote server — otherwise you will lock yourself out. Command: sudo ufw allow ssh then sudo ufw enable.

DEFAULT

Ubuntu Firewall

iptables

Backend Engine

IN/OUT

Traffic Control

IPv4+6

Protocol Support

1. Enable, Disable & Status

# ⚠️ Allow SSH FIRST before enabling on remote servers
sudo ufw allow ssh

# Enable / Disable UFW
sudo ufw enable                     # activate firewall
sudo ufw disable                    # deactivate firewall
sudo ufw reload                     # reload rules without disabling
sudo ufw reset                      # reset all rules to defaults

# Check status
sudo ufw status                     # basic status + rules
sudo ufw status verbose             # detailed status
sudo ufw status numbered            # show rules with numbers

# Example status output:
# Status: active
# To         Action  From
# 22/tcp     ALLOW   Anywhere
# 80/tcp     ALLOW   Anywhere
# 443/tcp    ALLOW   Anywhere

2. Default Policies

Default policies determine what happens to traffic that doesn't match any specific rule. Best practice: deny all incoming, allow all outgoing.

# Set default policies (recommended for servers)
sudo ufw default deny incoming      # block all inbound by default
sudo ufw default allow outgoing     # allow all outbound by default
sudo ufw default deny forward       # block forwarded traffic (routing)

# Permissive policy (not recommended for servers)
sudo ufw default allow incoming

3. Allow Rules

# Allow by service name
sudo ufw allow ssh                  # port 22
sudo ufw allow http                 # port 80
sudo ufw allow https                # port 443
sudo ufw allow ftp                  # port 21

# Allow by port number
sudo ufw allow 22                   # any protocol
sudo ufw allow 22/tcp               # TCP only
sudo ufw allow 53/udp               # UDP only (DNS)

# Allow port range
sudo ufw allow 6000:6007/tcp        # TCP ports 6000–6007
sudo ufw allow 60000:61000/udp      # UDP range (mosh)

# Allow from specific IP
sudo ufw allow from 203.0.113.10    # all traffic from this IP
sudo ufw allow from 203.0.113.10 to any port 22   # SSH from specific IP

# Allow from IP range (subnet)
sudo ufw allow from 192.168.1.0/24  # entire /24 subnet
sudo ufw allow from 192.168.1.0/24 to any port 3306  # MySQL from LAN only

# Allow to specific interface
sudo ufw allow in on eth0 to any port 80

4. Deny & Reject Rules

Deny drops packets silently. Reject drops and sends an error response to the sender.

# Deny incoming
sudo ufw deny 23                    # block Telnet
sudo ufw deny 23/tcp
sudo ufw deny from 198.51.100.5     # block specific IP
sudo ufw deny from 198.51.100.0/24  # block entire subnet

# Deny with destination
sudo ufw deny from 10.0.0.0/8 to any port 22

# Reject (sends RST/ICMP unreachable)
sudo ufw reject 23
sudo ufw reject from 198.51.100.5 to any port 22

# Block outgoing
sudo ufw deny out 25                # block outbound SMTP
sudo ufw deny out to 198.51.100.5  # block traffic to IP

5. Delete Rules

# Delete by rule specification
sudo ufw delete allow 80
sudo ufw delete allow ssh
sudo ufw delete deny 23/tcp
sudo ufw delete allow from 203.0.113.10

# Delete by rule number (from 'ufw status numbered')
sudo ufw status numbered            # list rules with numbers
sudo ufw delete 3                   # delete rule number 3

# Reset all rules
sudo ufw reset                      # removes all rules, disables UFW

6. Application Profiles

UFW includes pre-defined application profiles for common services. Profiles are defined in /etc/ufw/applications.d/.

# List available application profiles
sudo ufw app list

# View profile details
sudo ufw app info Apache
sudo ufw app info "Apache Full"
sudo ufw app info OpenSSH
sudo ufw app info Nginx

# Allow application profiles
sudo ufw allow OpenSSH              # SSH (port 22)
sudo ufw allow Apache               # HTTP only (port 80)
sudo ufw allow "Apache Full"        # HTTP + HTTPS (80 + 443)
sudo ufw allow "Apache Secure"      # HTTPS only (port 443)
sudo ufw allow Nginx                # Nginx HTTP
sudo ufw allow "Nginx Full"         # Nginx HTTP + HTTPS

# Create custom application profile
# /etc/ufw/applications.d/myapp
# [MyApp]
# title=My Application
# description=My custom app
# ports=8080/tcp
sudo ufw app update MyApp

7. Logging & Advanced

# Logging levels
sudo ufw logging off                # disable logging
sudo ufw logging on                 # enable (low level)
sudo ufw logging low                # blocked packets only
sudo ufw logging medium             # blocked + invalid packets
sudo ufw logging high               # all packets (verbose)
sudo ufw logging full               # maximum verbosity

# View UFW logs
sudo tail -f /var/log/ufw.log
sudo grep -i "BLOCK" /var/log/ufw.log  # show blocked connections
sudo journalctl -f | grep UFW          # systemd journal

# Common secure server setup
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh                  # allow SSH first!
sudo ufw allow http
sudo ufw allow https
sudo ufw deny 23                    # block Telnet
sudo ufw deny 3389                  # block RDP from internet
sudo ufw enable
sudo ufw status verbose

Quick Reference

Command	Description
ufw enable	Activate the firewall
ufw disable	Deactivate the firewall
ufw status verbose	Show all rules and status
ufw status numbered	Show rules with line numbers
ufw allow 22/tcp	Allow TCP port 22 (SSH)
ufw allow from IP	Allow all traffic from an IP
ufw deny 23	Block port 23 (Telnet)
ufw delete 3	Delete rule number 3
ufw app list	List application profiles
ufw reset	Remove all rules and disable
ufw logging on	Enable UFW logging
ufw reload	Reload rules gracefully