How to enable ufw on a VPS without cutting off SSH: allowing ports in the right order, checking rules, per-IP access, deleting rules, common errors.

ufw (Uncomplicated Firewall) is a front end for the Linux packet filter that lets you manage rules with short, readable commands. On a fresh VPS the firewall is usually off: every port where something listens is open to the internet. This guide covers turning ufw on so that only the ports you need are reachable from outside - without locking yourself out over SSH.

In short. The order is: first ufw allow OpenSSH, then any other ports you need, and only then ufw enable. If you turn the firewall on without allowing SSH, you lose access to the server. Check rules with ufw status verbose. By default ufw blocks all incoming connections and allows all outgoing ones.

What ufw does

With no firewall, any service that listens on a network port is reachable from the internet. Often that is unwanted: a database, a panel, a debug web server should be visible only to you or only locally. ufw closes all incoming by default and opens it selectively - port by port, and if you want, only for specific addresses.

ufw leaves outgoing connections alone: the server can still reach the internet for updates and external APIs.

What you need

  • Ubuntu or Debian with root access (or a user with sudo). The commands below omit sudo - add it if you are not running as root. On Ubuntu ufw is already installed; on Debian, if needed, apt install ufw.
  • A list of ports that should be open. At minimum, SSH (22). Plus the ones you actually need from outside: 80 and 443 for a site, others as the task requires.
  • A fallback way into the server. If you accidentally close SSH, you will need the provider's web console or rescue mode.

Step 1. Check the current state

ufw status

On a fresh server it prints Status: inactive - the firewall is off, there are no rules.

Step 2. Allow SSH - before enabling

This is the most important step. If you enable ufw without a rule for SSH, the current connection drops and you cannot get back in.

ufw allow OpenSSH

OpenSSH is a built-in application profile; it opens port 22/tcp. If your SSH is on a non-standard port, give the number: ufw allow 2222/tcp.

Step 3. Allow the other ports you need

ufw allow 80/tcp
ufw allow 443/tcp

Format: ufw allow <port>/<protocol>. Better to state the protocol (tcp or udp) explicitly - otherwise both tcp and udp are opened. A port range: ufw allow 60000:61000/udp. The application profiles ufw knows: ufw app list.

Step 4. Enable the firewall

ufw enable

ufw asks whether this will disrupt the current SSH connection. If step 2 is done, answer y. The firewall comes up immediately and on every boot.

Step 5. Check the rules

ufw status verbose

Shows the status, the default policy (deny (incoming), allow (outgoing)) and the list of open ports - for IPv4 and IPv6.

Rules with numbers (numbers are needed for deletion):

ufw status numbered

Open a port for one address only

Databases, panels, helper services should not be open to the whole internet. Allow access from your IP only:

ufw allow from 203.0.113.10 to any port 5432 proto tcp

Now port 5432 is reachable only from 203.0.113.10; for everyone else it is closed. You can also allow a whole subnet: from 203.0.113.0/24.

Deleting rules

By the number from ufw status numbered (numbers shift after each deletion, re-check):

ufw delete 4

Or by the same description you added the rule with:

ufw delete allow 80/tcp

Useful commands

  • ufw disable - turn the firewall off (rules are kept and apply on the next enable).
  • ufw reset - delete all rules and return to the default state.
  • ufw default deny incoming / ufw default allow outgoing - the default policy (usually already set).
  • ufw logging on - log blocked packets to /var/log/ufw.log.
  • ufw allow proto tcp from any to any port 80,443 - several ports in one rule.

Common errors

  • Lost SSH access after ufw enable. There was no rule for SSH. Get in through the web console or the provider's rescue mode, run ufw allow OpenSSH (or ufw disable), check and enable again.
  • You added a rule but the port is still closed. Check ufw status - maybe you forgot enable, or the service listens only on 127.0.0.1 (then it is not the firewall but the service's own config).
  • You opened 80 instead of 80/tcp. Without the protocol ufw opens both tcp and udp - unnecessary. State the protocol.
  • There are rules for IPv4 but not IPv6. ufw creates rules for both stacks by default; if there are no IPv6 lines, check IPV6=yes in /etc/default/ufw.
  • Docker "punches through" ufw. Docker writes its own iptables rules around ufw, and published container ports are open even if ufw did not allow them. Publish ports as 127.0.0.1:8080:80 or use a dedicated Docker + ufw setup.

Next steps