How To Set Up a Firewall With UFW on Ubuntu

UFW (Uncomplicated Firewall) is a front-end for iptables/nftables that ships with Ubuntu and makes it practical to manage firewall rules with short, readable commands instead of raw netfilter syntax. A freshly provisioned server has no firewall enforcing which ports are reachable, which means every listening service is exposed to the entire internet by default. This tutorial walks through installing UFW, setting a deny-by-default policy, opening only the ports you actually need, rate-limiting SSH against brute-force attempts, and verifying the rules work as expected.

Step 1 — Check that UFW is installed

UFW ships by default on Ubuntu, but confirm it's present before relying on it.

sudo ufw status

If this returns "Status: inactive" or a rule list, UFW is installed and you can move on. If you instead get "command not found", install it from Ubuntu's repositories:

sudo apt update
sudo apt install -y ufw

Step 2 — Set the default policy

Before opening any specific ports, set the baseline policy: deny all incoming connections, allow all outgoing ones. This means nothing is reachable until you explicitly allow it, while your server can still make outbound requests (updates, API calls, etc.) without restriction.

sudo ufw default deny incoming
sudo ufw default allow outgoing

These are stored as defaults and apply to any port that doesn't have a more specific rule, so you never end up with an implicitly open service.

Step 3 — Allow SSH before enabling UFW

Allow SSH using the registered OpenSSH application profile, which maps to port 22/tcp:

sudo ufw allow OpenSSH

If for some reason the OpenSSH profile isn't registered (for example, `openssh-server` was installed non-standard, or `ufw app list` doesn't show it), allow the port directly instead:

sudo ufw allow 22/tcp

If your SSH daemon listens on a non-default port, substitute that port number instead of 22 here — allowing 22/tcp won't help if sshd is actually bound to something else.