{"id":12239,"date":"2025-12-20T10:02:53","date_gmt":"2025-12-20T04:32:53","guid":{"rendered":"https:\/\/www.youstable.com\/blog\/?p=12239"},"modified":"2025-12-20T10:02:55","modified_gmt":"2025-12-20T04:32:55","slug":"setup-ufw-on-linux-server","status":"publish","type":"post","link":"https:\/\/www.youstable.com\/blog\/setup-ufw-on-linux-server","title":{"rendered":"How to Setup UFW on Linux Server"},"content":{"rendered":"\n<p>UFW (Uncomplicated Firewall) is a simple interface to manage iptables\/nftables on Linux. To set up UFW on a Linux server: install it, set default policies (deny incoming, allow outgoing), allow SSH, open required service ports (e.g., HTTP\/HTTPS), enable UFW, and verify rules. This protects your server with minimal, readable commands.<\/p>\n\n\n\n<p>If you\u2019re looking to setup UFW on a Linux server safely and quickly, this step-by-step guide covers everything from installation to advanced rules, troubleshooting, Docker considerations, and best practices. Written from a hosting and security perspective, it helps beginners get production-grade protection with a few commands\u2014without locking themselves out.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"what-is-ufw-and-why-use-it\"><strong>What is UFW and Why Use it?<\/strong><\/h2>\n\n\n\n<p>UFW (Uncomplicated Firewall) is a user friendly command-line tool that manages Linux firewall rules. Under the hood, it configures iptables or nftables depending on your distribution. It\u2019s included by default on Ubuntu and available for most Debian\/RHEL-based systems. UFW reduces complexity with human-readable commands like \u201callow 22\/tcp,\u201d making it ideal for developers and sysadmins.<\/p>\n\n\n\n<p>Key benefits:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Beginner-friendly syntax for secure defaults<\/li>\n\n\n\n<li>Quick rule management for common services (SSH, HTTP, HTTPS)<\/li>\n\n\n\n<li>Profiles for applications (OpenSSH, Apache, Nginx, Postfix)<\/li>\n\n\n\n<li>IPv4 and IPv6 support<\/li>\n\n\n\n<li>Persistent across reboots<\/li>\n\n\n\n<li>Works well on VPS, dedicated, and <a href=\"https:\/\/www.youstable.com\/blog\/tally-on-cloud-vs-local-installation\/\">cloud<\/a> servers<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"search-intent-secure-fast-and-reliable-ufw-setup\"><strong>Search Intent: Secure, Fast, and Reliable UFW Setup<\/strong><\/h2>\n\n\n\n<p>Most readers want a safe, copy-paste path to <a href=\"https:\/\/www.youstable.com\/blog\/how-to-enable-ssh-access-for-clients-or-users\/\">enable UFW without losing SSH access<\/a>, plus answers to common questions: how to allow services, open ports, block IPs, log and test rules, use IPv6, handle Docker, and recover from mistakes. This guide delivers that with a best-practice Quick Start and deep dives for production use.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"prerequisites-and-safety-checklist\"><strong>Prerequisites and Safety Checklist<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Root or sudo access on your Linux server<\/li>\n\n\n\n<li>Your SSH <a href=\"https:\/\/www.youstable.com\/blog\/webmail-port-numbers\/\">port number<\/a> (default 22; custom if you changed it)<\/li>\n\n\n\n<li>Service ports you plan to allow (e.g., 80, 443, 5432)<\/li>\n\n\n\n<li>Console\/serial access or recovery method from your provider in case of lockout<\/li>\n\n\n\n<li>For <a href=\"https:\/\/www.youstable.com\/blog\/what-is-dedicated-cloud-server\/\">cloud servers<\/a> (AWS, GCP, Azure, DigitalOcean): align security groups\/VPC firewalls with UFW<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"install-ufw-on-popular-linux-distributions\"><strong>Install UFW on Popular Linux Distributions<\/strong><\/h2>\n\n\n\n<p>On Ubuntu and Debian, UFW is often installed by default. If not, install it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update\nsudo apt install ufw<\/code><\/pre>\n\n\n\n<p>On Fedora:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf install ufw\n# Fedora defaults to firewalld. If you choose UFW, stop\/disable firewalld first:\nsudo systemctl stop firewalld\nsudo systemctl <a href=\"https:\/\/www.youstable.com\/blog\/how-to-stop-and-disable-firewalld\/\">disable firewalld<\/a>\nsudo systemctl mask firewalld\nsudo systemctl enable ufw\nsudo systemctl start ufw<\/code><\/pre>\n\n\n\n<p>On RHEL, AlmaLinux, Rocky Linux (enable EPEL if required):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf install epel-release -y\nsudo dnf install ufw -y\nsudo systemctl stop firewalld\nsudo systemctl disable firewalld\nsudo systemctl mask firewalld\nsudo systemctl enable ufw\nsudo systemctl start ufw<\/code><\/pre>\n\n\n\n<p>Important: Do not run firewalld and UFW simultaneously. Choose one firewall manager to avoid conflicts.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"quick-start-secure-setup-in-5-minutes\"><strong>Quick Start: Secure Setup in 5 Minutes<\/strong><\/h2>\n\n\n\n<p>Follow this safe sequence to configure UFW without losing access.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># 1) Check if IPv6 should be managed too (recommended on dual-stack servers)\nsudo nano \/etc\/default\/ufw\n# Ensure: IPV6=yes\n# Save and exit if you changed it:\n# Then reload defaults after enabling later\n\n# 2) Allow SSH FIRST (replace 22 if using a custom port)\nsudo ufw allow 22\/tcp comment 'SSH'\n\n# 3) Set sensible defaults\nsudo ufw default deny incoming\nsudo ufw default allow outgoing\n\n# 4) Allow <a href=\"https:\/\/www.youstable.com\/blog\/web-servers-and-explaination\/\">web traffic if this is a web server<\/a>\nsudo ufw allow 80\/tcp comment 'HTTP'\nsudo ufw allow 443\/tcp comment 'HTTPS'\n\n# 5) Enable UFW (type 'y' to proceed)\nsudo ufw enable\n\n# 6) Verify\nsudo ufw status verbose<\/code><\/pre>\n\n\n\n<p>If you changed \/etc\/default\/ufw for IPv6, apply and reload:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw reload\nsudo ufw status numbered<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"essential-ufw-commands-cheat-sheet\"><strong>Essential UFW Commands (Cheat Sheet)<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable\/Disable: <code>sudo ufw enable<\/code>, <code>sudo ufw disable<\/code><\/li>\n\n\n\n<li>Status: <code>sudo ufw status<\/code>, <code>sudo ufw status verbose<\/code>, <code>sudo ufw status numbered<\/code><\/li>\n\n\n\n<li>Allow\/Deny: <code>sudo ufw allow 22\/tcp<\/code>, <code>sudo ufw deny 25\/tcp<\/code><\/li>\n\n\n\n<li>Delete by number: <code>sudo ufw status numbered<\/code> then <code>sudo ufw delete &lt;num&gt;<\/code><\/li>\n\n\n\n<li>Rate limit (SSH): <code>sudo ufw limit 22\/tcp<\/code><\/li>\n\n\n\n<li>Allow a range: <code>sudo ufw allow 10000:20000\/tcp<\/code><\/li>\n\n\n\n<li>Allow by IP\/subnet: <code>sudo ufw allow from 203.0.113.10 to any port 22 proto tcp<\/code>, <code>sudo ufw allow from 10.0.0.0\/24 to any port 5432<\/code><\/li>\n\n\n\n<li>Interface-specific: <code>sudo ufw allow in on eth0 to any port 22<\/code><\/li>\n\n\n\n<li>Logging: <code>sudo ufw logging on<\/code> (levels: off, low, medium, high, full)<\/li>\n\n\n\n<li>Reset: <code>sudo ufw reset<\/code> (removes rules; use carefully)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"configure-common-services\"><strong>Configure Common Services<\/strong><\/h2>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"ssh-remote-access\"><strong>SSH (Remote Access)<\/strong><\/h2>\n\n\n\n<p>Always allow your SSH port before enabling UFW. If you moved SSH to a custom port (e.g., 2222), adjust accordingly:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Default\nsudo ufw allow 22\/tcp comment 'SSH'\n\n# Custom\nsudo ufw allow 2222\/tcp comment 'SSH (custom port)'\n\n# Add rate limiting to slow brute-force attempts\nsudo ufw limit 22\/tcp<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"web-servers-nginx-apache\"><strong>Web Servers (Nginx\/Apache)<\/strong><\/h2>\n\n\n\n<p>On Ubuntu, UFW can use application profiles:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Show available app profiles\nsudo ufw app list\n\n# Common profiles:\nsudo ufw allow 'Nginx Full'        # 80,443\nsudo ufw allow 'Apache Full'       # 80,443<\/code><\/pre>\n\n\n\n<p>Generic port-based rules work everywhere:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw allow 80\/tcp\nsudo ufw allow 443\/tcp<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"databases-postgresql-mysql-mariadb\"><strong>Databases (PostgreSQL, MySQL\/MariaDB)<\/strong><\/h2>\n\n\n\n<p>Only allow database ports from trusted hosts or private networks.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># PostgreSQL (5432) from app server only\nsudo ufw allow from 10.0.0.10 to any port 5432 proto tcp\n\n# MySQL\/MariaDB (3306) from specific subnet\nsudo ufw allow from 10.0.1.0\/24 to any port 3306 proto tcp<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"mail-ftp-and-other-services\"><strong>Mail, FTP, and Other Services<\/strong><\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code># SMTP\nsudo ufw allow 25\/tcp\n\n# SMTPS\/Submission\nsudo ufw allow 465\/tcp\nsudo ufw allow 587\/tcp\n\n# IMAP(S) and POP3(S)\nsudo ufw allow 993\/tcp\nsudo ufw allow 995\/tcp\n\n# FTP (and passive range example)\nsudo ufw allow 21\/tcp\nsudo ufw allow 30000:31000\/tcp<\/code><\/pre>\n\n\n\n<p>For FTP passive mode, also configure your FTP server to use the same passive port range.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"advanced-ufw-rules-and-scenarios\"><strong>Advanced UFW Rules and Scenarios<\/strong><\/h2>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"default-policies\"><strong>Default Policies<\/strong><\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code># Recommended defaults\nsudo ufw default deny incoming\nsudo ufw default allow outgoing\n\n# For hardened egress control (optional)\nsudo ufw default deny outgoing\n# Then allow specific outbound destinations\/ports as needed<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"allow-by-source-port-protocol\"><strong>Allow by Source, Port, Protocol<\/strong><\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code># Single IP\nsudo ufw allow from 203.0.113.5 to any port 22 proto tcp\n\n# CIDR subnet\nsudo ufw allow from 10.10.0.0\/16 to any port 9200 proto tcp\n\n# UDP example (DNS)\nsudo ufw allow 53\/udp<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"interface-specific-rules\"><strong>Interface-Specific Rules<\/strong><\/h2>\n\n\n\n<p>Helpful when your server has public and private interfaces:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Only allow SSH on public interface eth0\nsudo ufw allow in on eth0 to any port 22 proto tcp\n\n# Allow database only on private interface eth1\nsudo ufw allow in on eth1 to any port 5432 proto tcp<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"port-ranges-and-service-groups\"><strong>Port Ranges and Service Groups<\/strong><\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code># TCP range\nsudo ufw allow 2000:2100\/tcp\n\n# UDP range\nsudo ufw allow 60000:61000\/udp<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"rate-limiting-and-brute-force-mitigation\"><strong>Rate Limiting and Brute-Force Mitigation<\/strong><\/h2>\n\n\n\n<p>Rate limiting throttles repeated connection attempts from the same IP:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw limit 22\/tcp\nsudo ufw limit 80\/tcp\nsudo ufw limit 443\/tcp<\/code><\/pre>\n\n\n\n<p>For deeper protection, pair UFW with Fail2ban to dynamically ban abusive IPs based on log patterns.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"ipv6-support\"><strong>IPv6 Support<\/strong><\/h2>\n\n\n\n<p>Enable IPv6 in \/etc\/default\/ufw (IPV6=yes) and reload. UFW will then manage ip6tables\/nftables rules to match your IPv4 policy, ensuring your server isn\u2019t exposed over IPv6 unintentionally.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"nat-forwarding-and-port-redirection\"><strong>NAT, Forwarding, and Port Redirection<\/strong><\/h2>\n\n\n\n<p>UFW can handle NAT and forwarding by editing before.rules and default forward policy. Example: redirect port 80 to 8080 on the same server.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># 1) Enable forwarding in \/etc\/default\/ufw\nDEFAULT_FORWARD_POLICY=\"ACCEPT\"\n\n# 2) Edit \/etc\/ufw\/before.rules (IPv4) and add before the *filter section:\n*nat\n:PREROUTING ACCEPT &#91;0:0]\n:POSTROUTING ACCEPT &#91;0:0]\n-A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080\nCOMMIT\n\n# 3) Reload\nsudo ufw reload<\/code><\/pre>\n\n\n\n<p>Be cautious: NAT changes impact traffic flow. Test carefully and document your modifications.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"ufw-and-docker-what-you-need-to-know\"><strong>UFW and Docker: What You Need to Know<\/strong><\/h2>\n\n\n\n<p>Docker manipulates iptables directly, which can bypass UFW\u2019s default policy. By default, published container ports are open on the host even if UFW denies incoming. Options:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Bind containers to specific interfaces (e.g., 127.0.0.1) and reverse-proxy via Nginx that UFW controls.<\/li>\n\n\n\n<li>Use Docker\u2019s user-defined bridge networks and avoid <code>--publish<\/code> except through a controlled proxy.<\/li>\n\n\n\n<li>Harden Docker\u2019s iptables behavior (dockerd flags) if you know what you\u2019re doing.<\/li>\n<\/ul>\n\n\n\n<p>Practical approach: expose services via Nginx on 80\/443, secure those ports with UFW, and keep containers on internal networks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"testing-verification-and-logging\"><strong>Testing, Verification, and Logging<\/strong><\/h2>\n\n\n\n<p>Verify open ports and rules after enabling UFW:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># On the server\nsudo ufw status verbose\nss -tulpn\n\n# From a remote host\nnmap -Pn &lt;server_ip&gt;\nnc -zv &lt;server_ip&gt; 22\ncurl -I http:\/\/&lt;server_ip&gt;<\/code><\/pre>\n\n\n\n<p>Enable logging to capture dropped\/allowed traffic:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw logging medium\n# Logs usually at \/var\/log\/ufw.log (or via syslog\/journal)\nsudo tail -f \/var\/log\/ufw.log<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"troubleshooting-and-recovery\"><strong>Troubleshooting and Recovery<\/strong><\/h2>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"avoiding-lockouts\"><strong>Avoiding Lockouts<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Always allow SSH (correct port) before enabling UFW.<\/li>\n\n\n\n<li>Open a second SSH session before applying changes so you can revert if the first session drops.<\/li>\n\n\n\n<li>Keep console\/serial access ready from your hosting panel.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"common-fixes\"><strong>Common Fixes<\/strong><\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code># If you lost access (via console):\nsudo ufw disable\n\n# Re-allow SSH and re-enable:\nsudo ufw allow 22\/tcp\nsudo ufw enable\n\n# Reset all rules (careful: wipes configuration)\nsudo ufw reset\nsudo ufw default deny incoming\nsudo ufw default allow outgoing\nsudo ufw allow 22\/tcp\nsudo ufw enable\n\n# Delete a bad rule by number\nsudo ufw status numbered\nsudo ufw delete &lt;number&gt;<\/code><\/pre>\n\n\n\n<p>If services are blocked by an upstream firewall (AWS Security Groups, Cloud provider firewalls), adjust those rules to match UFW. Both layers must allow the traffic.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"hardening-tips-and-best-practices\"><strong>Hardening Tips and Best Practices<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Least privilege: Allow only required ports\/IPs; deny everything else.<\/li>\n\n\n\n<li>Prefer IP- or subnet-restricted rules for admin services and databases.<\/li>\n\n\n\n<li>Enable IPv6 management and ensure parity between IPv4 and IPv6 rules.<\/li>\n\n\n\n<li>Use rate limiting on SSH and high-risk ports; add Fail2ban for dynamic bans.<\/li>\n\n\n\n<li>Segment networks: use private subnets for backend services.<\/li>\n\n\n\n<li>Log at \u201cmedium\u201d or \u201chigh\u201d temporarily when diagnosing; revert to \u201clow\u201d for normal operation.<\/li>\n\n\n\n<li>Document every rule with a comment so teams understand intent.<\/li>\n\n\n\n<li>Review rules quarterly; remove stale allowances.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"automating-ufw-cloud-init-and-ansible\"><strong>Automating UFW (Cloud-Init and Ansible)<\/strong><\/h2>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"cloud-init-snippet\"><strong>Cloud-Init Snippet<\/strong><\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>#cloud-config\npackages:\n  - ufw\nruncmd:\n  - sed -i 's\/IPV6=no\/IPV6=yes\/' \/etc\/default\/ufw\n  - ufw default deny incoming\n  - ufw default allow outgoing\n  - ufw allow 22\/tcp comment 'SSH'\n  - ufw allow 80\/tcp comment 'HTTP'\n  - ufw allow 443\/tcp comment 'HTTPS'\n  - yes | ufw enable\n  - ufw status verbose<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"ansible-task-example\"><strong>Ansible Task Example<\/strong><\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>- name: Install UFW\n  apt:\n    name: ufw\n    state: present\n  become: yes\n\n- name: Configure UFW defaults\n  ufw:\n    state: enabled\n    policy: deny\n    direction: incoming\n  become: yes\n\n- name: Allow outgoing by default\n  command: ufw default allow outgoing\n  become: yes\n\n- name: Allow SSH, HTTP, HTTPS\n  ufw:\n    rule: allow\n    port: \"{{ item }}\"\n    proto: tcp\n  loop:\n    - \"22\"\n    - \"80\"\n    - \"443\"\n  become: yes<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"ufw-vs-firewalld-vs-iptables-nftables\"><strong>UFW vs. firewalld vs. iptables\/nftables<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>UFW: Simple, human-readable, great for most single-host setups and Ubuntu\/Debian environments.<\/li>\n\n\n\n<li>firewalld: Default on RHEL\/Fedora-based systems; dynamic zones and services; good for complex, multi-interface environments.<\/li>\n\n\n\n<li>iptables\/nftables: Low-level, most flexible; steeper learning curve; ideal for advanced scenarios and custom automation.<\/li>\n<\/ul>\n\n\n\n<p>Choose the tool your team can manage well. Consistency and correct policy are more important than the specific framework.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"real-world-example-production-web-app\"><strong>Real-World Example: Production Web App<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Web VM: allow 22\/tcp from office IPs only; allow 80\/443 to the world; route app traffic to containers via Nginx; deny everything else.<\/li>\n\n\n\n<li>DB VM: allow 5432 only from the Web VM private subnet; no public DB access.<\/li>\n\n\n\n<li>Cache VM: allow 6379 only from Web VM private subnet; no public access.<\/li>\n\n\n\n<li>Monitoring: allow 9100 and 9090 from monitoring subnet only.<\/li>\n<\/ul>\n\n\n\n<p>This follows least privilege and isolates critical services while keeping the public surface minimal.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"soft-recommendation-secure-hosting-with-youstable\"><strong>Soft Recommendation: Secure Hosting with YouStable<\/strong><\/h2>\n\n\n\n<p>As a <a href=\"https:\/\/www.youstable.com\/blog\/best-web-hosting-provider-in-india\/\">hosting provider<\/a>, YouStable offers SSD-powered VPS and dedicated servers where you can deploy UFW-ready images, leverage DDoS protection, and get guidance on firewall hardening. If you\u2019re migrating or scaling, our team can help you set up UFW policies aligned with your stack and compliance needs.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"faqs-setup-ufw-on-linux-server\"><strong>FAQs: Setup UFW on Linux Server<\/strong><\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1765457317068\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \" class=\"rank-math-question \" id=\"is-ufw-enabled-by-default-on-ubuntu\"><strong>Is UFW enabled by default on Ubuntu?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. UFW is installed by default on many Ubuntu images but not always enabled. Check with <code>sudo ufw status<\/code>. If it says \u201cinactive,\u201d configure your rules and run <code>sudo ufw enable<\/code>.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1765457323812\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \" class=\"rank-math-question \" id=\"how-do-i-allow-ssh-safely-before-enabling-ufw\"><strong>How do I allow SSH safely before enabling UFW?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Run <code>sudo ufw allow 22\/tcp<\/code> (or your custom SSH port) first, then set defaults (<code>deny incoming<\/code>, <code>allow outgoing<\/code>), then <code>sudo ufw enable<\/code>. Keep a second SSH session open to test and revert if needed.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1765457331328\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \" class=\"rank-math-question \" id=\"how-do-i-open-a-port-with-ufw\"><strong>How do I open a port with UFW?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Use <code>sudo ufw allow &lt;port&gt;\/&lt;proto&gt;<\/code>. For example, open HTTP and HTTPS with <code>sudo ufw allow 80\/tcp<\/code> and <code>sudo ufw allow 443\/tcp<\/code>. You can also allow ranges: <code>sudo ufw allow 10000:20000\/tcp<\/code>.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1765457347012\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \" class=\"rank-math-question \" id=\"how-do-i-block-a-specific-ip-with-ufw\"><strong>How do I block a specific IP with UFW?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Use a deny rule, optionally for a specific port: <code>sudo ufw deny from 203.0.113.10<\/code> or <code>sudo ufw deny from 203.0.113.10 to any port 22 proto tcp<\/code>. Check precedence: more specific rules (by IP and port) match before broad rules.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1765457351728\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \" class=\"rank-math-question \" id=\"does-ufw-work-with-ipv6\"><strong>Does UFW work with IPv6?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Yes. Set <code>IPV6=yes<\/code> in <code>\/etc\/default\/ufw<\/code>, then reload. UFW will manage both IPv4 and IPv6 rules, keeping your policy consistent across stacks.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1765457360399\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \" class=\"rank-math-question \" id=\"how-do-i-reset-or-remove-all-ufw-rules\"><strong>How do I reset or remove all UFW rules?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Run <code>sudo ufw reset<\/code> to delete all rules and restore defaults. Then reapply your policy: defaults, allow SSH, required ports, and <code>sudo ufw enable<\/code>. Be careful when running reset on remote servers.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1765457381513\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \" class=\"rank-math-question \" id=\"is-ufw-better-than-firewalld\"><strong>Is UFW better than firewalld?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>They solve the same problem with different approaches. UFW is simpler and common on Ubuntu\/Debian. firewalld is default on RHEL\/Fedora and offers zones and dynamic management. Choose the one that fits your distro and team skill set; don\u2019t run both together.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"final-word\"><strong>Final Word<\/strong><\/h2>\n\n\n\n<p>Setting up UFW on a Linux server is one of the fastest ways to reduce your attack surface. Use deny-by-default, allow only essential services, enable IPv6, log thoughtfully, and test thoroughly. With the quick-start steps and advanced examples above, you can move from basic protection to a hardened, production-ready firewall policy in minutes.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>UFW (Uncomplicated Firewall) is a simple interface to manage iptables\/nftables on Linux. To set up UFW on a Linux server: [&hellip;]<\/p>\n","protected":false},"author":13,"featured_media":15446,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[350],"tags":[],"class_list":["post-12239","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-knowledgebase"],"acf":[],"featured_image_src":"https:\/\/www.youstable.com\/blog\/wp-content\/uploads\/2025\/12\/How-to-Setup-UFW-on-Linux-Server.jpg","author_info":{"display_name":"Prahlad Prajapati","author_link":"https:\/\/www.youstable.com\/blog\/author\/prahladblog"},"_links":{"self":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/12239","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/comments?post=12239"}],"version-history":[{"count":5,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/12239\/revisions"}],"predecessor-version":[{"id":15447,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/12239\/revisions\/15447"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/media\/15446"}],"wp:attachment":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/media?parent=12239"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/categories?post=12239"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/tags?post=12239"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}