> For the complete documentation index, see [llms.txt](https://docs.ititanhosting.ro/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ititanhosting.ro/docs/english/vps/linux/how-to-set-up-a-firewall-with-ufw-on-ubuntu.md).

# How to set up a firewall with UFW on Ubuntu

UFW (Uncomplicated Firewall) is the easiest way to protect your VPS from unwanted traffic. It comes built into Ubuntu and takes about five minutes to configure.

Think of it as a bouncer for your server. Without a firewall, every port is open by default. With UFW, you decide exactly who gets in.

### Step 1: Check if UFW is installed

UFW ships with Ubuntu by default, but let us confirm:

```bash
sudo ufw version
```

If you see a version number, you are good to go. If not, install it:

```bash
sudo apt update && sudo apt install ufw -y
```

### Step 2: Set default policies

The safest approach is to deny all incoming traffic by default and allow all outgoing traffic:

```bash
sudo ufw default deny incoming
sudo ufw default allow outgoing
```

This way, nothing from the outside can reach your server unless you specifically allow it.

### Step 3: Allow SSH (very important)

If you are connected via SSH right now, blocking port 22 would lock you out of your server. Allow SSH first:

```bash
sudo ufw allow ssh
```

This is the same as running `sudo ufw allow 22/tcp`.

### Step 4: Allow other services you need

Think about what your server is going to do. Here are common rules:

Web server (HTTP and HTTPS):

```bash
sudo ufw allow http
sudo ufw allow https
```

Or if you prefer specifying ports:

```bash
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
```

For a specific port like a game server or custom app:

```bash
sudo ufw allow 25565/tcp
```

For a specific IP address only (most secure):

```bash
sudo ufw allow from 203.0.113.4 to any port 22
```

### Step 5: Enable UFW

Double-check your rules before enabling:

```bash
sudo ufw show added
```

If everything looks right, enable the firewall:

```bash
sudo ufw enable
```

Type `y` when it asks for confirmation. UFW will start immediately and activate on every boot from now on.

### Step 6: Check the status

```bash
sudo ufw status verbose
```

You should see something like this:

```
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere
22/tcp (v6)                ALLOW IN    Anywhere (v6)
80/tcp (v6)                ALLOW IN    Anywhere (v6)
443/tcp (v6)               ALLOW IN    Anywhere (v6)
```

### Managing rules after setup

Delete a rule:

```bash
sudo ufw delete allow 80/tcp
```

Block a specific IP:

```bash
sudo ufw deny from 203.0.113.4
```

Reload after making changes:

```bash
sudo ufw reload
```

Disable UFW temporarily (not recommended for long term):

```bash
sudo ufw disable
```

### Application profiles

Some services register themselves with UFW. See what is available:

```bash
sudo ufw app list
```

Then allow by profile name:

```bash
sudo ufw allow 'Nginx Full'
```

### Rate limiting

To protect against brute force attacks on SSH, enable rate limiting:

```bash
sudo ufw limit ssh
```

This allows 6 connections per 30 seconds from the same IP. Any more than that gets blocked automatically.

### Checking logs

If something is not working, check the firewall logs:

```bash
sudo tail -f /var/log/ufw.log
```

### Common mistakes

**Locking yourself out.** Always allow SSH before enabling UFW. If you do get locked out, restart your VPS from the hosting panel and disable UFW from the recovery console.

**Forgetting to allow a port.** If a service is not working after enabling UFW, check if the port is allowed. Run `sudo ufw status` and look for the port. If it is missing, add it.

**Allowing everything.** The whole point of UFW is to restrict access. Only open the ports you actually use. Every open port is a potential entry point.

### Done

Your VPS now has a basic firewall in place. It will block unwanted traffic while letting your services work normally. Not bad for five minutes of work.