Easy Firewall Management with UFW on Linux Servers

UFW on Linux servers is a firewall tool that simplifies the complex iptables rules, making firewall management for SSH, HTTP, HTTPS, and custom ports quick and secure. Especially on Ubuntu and Debian-based servers, UFW allows you to close default incoming traffic, open necessary services, permit specific IP addresses, and limit failed attempts. The recommended approach for a secure start is straightforward: secure SSH access, deny default incoming traffic, allow outgoing traffic, open only used service ports, and regularly check UFW status.

Once a web server is exposed to the internet, it is immediately subject to bot scans, password attempts, vulnerability scanners, and unnecessary port queries. Therefore, a firewall is one of the first layers of security for Linux servers. UFW is a practical tool favored by technical teams for daily operations; it features readable commands, quick rule addition and deletion, logging capabilities, and reduces the risk of misconfiguration compared to iptables commands. This guide will cover UFW installation, basic commands, preventing SSH lockouts, web server ports, IP-based permissions, log monitoring, IPv6, special cases like Docker, and security best practices compliant with 2026 standards step-by-step.

What is UFW and What Does It Do?

UFW stands for Uncomplicated Firewall. It can be translated into Turkish as "basit güvenlik duvarı." It utilizes the Linux kernel's packet filtering infrastructure in the background but offers more comprehensible commands for system administrators. For instance, instead of writing iptables or nftables rules directly, you can allow HTTPS traffic with the command sudo ufw allow 443/tcp.

UFW is particularly useful in the following scenarios:

• Quickly ensuring basic network security on a newly created VPS or dedicated server.
• Keeping only ports 80 and 443 open on a web server.
• Limiting SSH access to specific IP addresses only.
• Managing SSH connections with limits to reduce brute force attempts.
• Not leaving test, staging, and admin panels completely open to the internet.
• Tracking suspicious connections through logs.

While UFW alone does not solve all security issues, it does reduce the attack surface. When used alongside strong passwords, SSH key access, regular updates, SSL/TLS configuration, and application security, it forms a highly effective foundational layer. If you are hosting a website on your server, you should also not neglect the use of an SSL certificate along with the firewall SSL Certificates.

Comparing UFW, iptables, and firewalld

There are various tools available for firewall management in the Linux ecosystem. UFW, iptables, and firewalld often serve the same purpose; however, their ease of use, distribution support, and management approaches differ. The table below will help you make a decision.

If you are managing an Ubuntu-based web server, UFW is sufficient for most needs. In larger enterprise networks or multi-layered security architectures, UFW should be considered alongside cloud security groups, WAF, IDS/IPS, and centralized logging solutions.

Installing UFW and Initial Checks

UFW usually comes pre-installed on Ubuntu. However, it is a good starting point to check whether it is installed. Command: sudo ufw status. If you receive an output like command not found, you will need to install it.

Installation on Ubuntu and Debian

First, update the package list: sudo apt update. Then install UFW: sudo apt install ufw -y. After installation, check the service status: sudo systemctl status ufw. Even if it does not appear active in the output, this may be normal; UFW can remain passive until rules are activated.

The first rule in server management is to avoid rushing. If you are working on a remote VPS, make sure you allow the SSH port before enabling UFW. Otherwise, you risk losing access to your own server. If you are using a VPS from Hostragons, it is a practical precaution to note panel access and console options before making the initial security configuration VPS Server.

Viewing the Current Status

You can use the command sudo ufw status verbose to see UFW's status. For a more detailed and numbered rule list, the command sudo ufw status numbered is important. When deleting rules, the numbered list provides significant convenience. For example, to delete a port you accidentally opened, you first look at its number and then remove it with a command like sudo ufw delete 3.

Secure Start: Default Rules

The generally safest starting model on a new Linux server is as follows: deny incoming connections by default, allow outgoing connections, and only open necessary ports. This approach aligns with the principle of least privilege.

Basic commands to apply:

• sudo ufw default deny incoming
• sudo ufw default allow outgoing
• sudo ufw allow OpenSSH or sudo ufw allow 22/tcp
• sudo ufw enable
• sudo ufw status verbose

The critical point here is SSH access. If SSH is running on a different port, for example, 2222, do not enable UFW without executing the command sudo ufw allow 2222/tcp. Changing the standard port 22 for SSH does not provide security on its own; however, it can reduce automated bot attempts. More importantly, it is essential to disable password login for SSH and use key-based access.

Securing SSH Access

SSH is the management gateway to your server. Therefore, it is the service that needs to be handled with the utmost care in UFW configuration. If SSH access is open from every IP address, automated scanners on the internet can quickly begin probing your server.

Allowing SSH Port

If you are using the standard port, the command is simple: sudo ufw allow 22/tcp. If there is an existing Ubuntu application profile, you can also use sudo ufw allow OpenSSH. If you are using a different port, for example, for 2222, the command would be sudo ufw allow 2222/tcp.

Restricting SSH Access to Specific IPs

One of the safest methods is to open SSH access only to fixed admin IP addresses. For example, if your office IP address is 203.0.113.10, you can use the command: sudo ufw allow from 203.0.113.10 to any port 22 proto tcp. This way, the SSH port will not remain generally open to the internet.

If there are multiple administrators, add a separate rule for each IP. If you are using a dynamic IP, carefully consider this method; your access may be interrupted if your IP changes. In such cases, managing through a VPN, using a bastion host, or emergency console access from your provider's panel is a more professional solution.

Using Limits to Mitigate Brute Force Attempts

UFW offers a limit command to reduce frequent connection attempts. Command: sudo ufw limit 22/tcp. This rule helps to limit excessive connection attempts over certain intervals. However, it does not completely replace tools like fail2ban. For SSH security in production environments, UFW limit should be used in conjunction with fail2ban, key-based access, and strong user policies.

Opening Web Server Ports: HTTP and HTTPS

To publish a website, ports 80/tcp and 443/tcp are generally required. Port 80 is for HTTP, while port 443 is for HTTPS traffic. Modern SEO, browser security, and user trust have made HTTPS the standard. Sites without SSL certificates may face security warnings and experience conversion rate losses SSL Certificates.

Basic Rules for Nginx or Apache

The command for HTTP is: sudo ufw allow 80/tcp. The command for HTTPS is: sudo ufw allow 443/tcp. To open both simultaneously, instead of using sudo ufw allow 80,443/tcp, writing them separately is a more readable choice for most administrators.

UFW application profiles can also be utilized. For Nginx, you can view profiles with the command sudo ufw app list. For instance, the Nginx Full profile allows access to both HTTP and HTTPS. Command: sudo ufw allow Nginx Full. Similarly, the Apache Full profile can be used on the Apache side.

Is Just Using HTTPS Enough?

Technically, your site can be published solely over HTTPS; however, certificate renewal processes like Let’s Encrypt and redirecting from HTTP to HTTPS typically require port 80 to be open in most scenarios. Therefore, it is more practical to manage ports 80 and 443 together on web servers. The best approach is to redirect all HTTP requests to HTTPS with a 301 redirect at the application level.

Special Ports, Databases, and Management Panels

Opening any port is easy, but the real expertise lies in knowing which ports should not be opened. Ports like 3306 for MySQL, 5432 for PostgreSQL, 6379 for Redis, and 9200 for Elasticsearch can pose serious security risks if left open to the internet. These services should ideally listen only on localhost or be accessible through a private network.

Opening a Special Port to a Specific IP

If you only want your application server to access the database server, you should use an IP-based rule. Command: sudo ufw allow from 198.51.100.25 to any port 5432 proto tcp. This rule opens PostgreSQL access only to the specified IP.

An incorrect example would be using sudo ufw allow 5432/tcp publicly on a production database. This creates unnecessary attack surfaces. Resource IP restrictions should always be considered for database servers, management panels, and internal services.

Attention with cPanel, Plesk, and Management Panels

Hosting control panels can use multiple ports. If you are using Plesk, cPanel, or a custom management panel, do not enable UFW without checking the official port list. Otherwise, email, DNS, FTP, or panel access may be interrupted. For users who prefer managed hosting, this complexity is typically handled by the provider Web Hosting.

Deleting, Editing Rules, and Logic of Ordering

Rule management with UFW is simple; however, it is important to keep records when making changes in a production environment. First, view the existing rules in a numbered manner: sudo ufw status numbered. Find the number of the rule you want to delete and remove it with a command like sudo ufw delete 5.

It is also possible to delete using the direct rule expression. For example, the command sudo ufw delete allow 8080/tcp removes the allow rule for port 8080. However, for complex IP-based rules, numbered deletion is safer.

Rule order becomes particularly important when allow and deny rules are used together. If you want to add a specific deny rule before a general allow rule, consider using the insert command. For example, to deny a specific IP at the top, you can use sudo ufw insert 1 deny from 203.0.113.55. This approach is useful for quickly blocking attacking or abusive IP addresses.

Monitoring Traffic with UFW Logs

A firewall is not only for opening and closing ports but also valuable for understanding network behavior. To enable UFW logs, use the command sudo ufw logging on. The log level can be adjusted to low, medium, high, or full if necessary. For most servers, low is sufficient for initial setup.

You can check the logs by looking at the /var/log/ufw.log file. Example command: sudo tail -f /var/log/ufw.log. Here, you can see rejected connections, source IP addresses, target ports, and protocol information. For instance, if there are hundreds of attempts from different IPs to port 22 in a short period, you need to tighten SSH security measures.

Keeping logs at a high level continuously can increase disk usage. Therefore, log rotation, centralized logging, and alarm mechanisms should be considered for servers that experience high traffic. In corporate projects, it is important not only to keep security records but also to monitor them meaningfully.

IPv6 and UFW Settings

As of 2026, IPv6 support has become standard in many data centers. However, some administrators may leave security vulnerabilities by only considering IPv4 rules. If your server receives an IPv6 address, you must ensure that UFW also manages IPv6 traffic.

To check, the line IPV6=yes should be present in the /etc/default/ufw file. After making changes, UFW can be restarted: sudo ufw disable and then sudo ufw enable. If you see rules labeled with v6 in the UFW status output, it means IPv6 is being managed as well.

If you are not using IPv6, check the provider and application requirements before disabling it completely. A misconfigured IPv6 can allow access to a service that you have closed on the IPv4 side. This is a common but overlooked security error.

Why Might UFW Behave Differently When Using Docker?

Docker can directly change iptables rules when publishing container ports. This situation can be surprising for administrators using UFW; a port that appears closed in UFW may become accessible from the outside due to a Docker publish setting. For example, the command docker run -p 8080:80 publishes port 80 inside the container as 8080 on the host.

On servers using Docker, the following checks should be made:

• Examine which ports are exposed in the docker ps output.
• Remove unnecessary -p or ports definitions.
• Consider only publishing services on 127.0.0.1.
• Check cloud security groups and UFW rules together.
• In production environments, publish through a reverse proxy in a controlled manner.

Security in container architectures is not solely about UFW commands. Docker networks, image security, secret management, and update strategies should be planned together. Choosing the right server for high traffic applications is also critical for security and performance Dedicated Server.

Applicable Security Checklist for UFW

The following checklist can be used as a practical start standard on a newly established Linux server. Particularly before publishing a web project, API, e-commerce site, or customer panel, reviewing these items reduces downtime and security risks.

• Update the server: sudo apt update && sudo apt upgrade -y.
• Test SSH access and leave a second terminal session open if possible.
• Deny default incoming traffic: sudo ufw default deny incoming.
• Allow default outgoing traffic: sudo ufw default allow outgoing.
• Allow SSH port or implement IP-based restrictions.
• Open only ports 80 and 443 for the web server.
• Do not open database ports to the public internet.
• Enable UFW: sudo ufw enable.
• Verify rules: sudo ufw status verbose and sudo ufw status numbered.
• Enable logging and check for suspicious traffic within the first 24 hours.
• Review IPv6 rules.
• If using Docker or a control panel, test for additional port effects.

Real-World Example: UFW Setup for a WordPress Server

Assume you have a single WordPress site running on Ubuntu with Nginx, PHP-FPM, and MySQL. MySQL is only listening on localhost, the site is published over HTTPS, and SSH will be accessed from the admin IP. In this scenario, the UFW configuration could be:

• sudo ufw default deny incoming
• sudo ufw default allow outgoing
• sudo ufw allow from 203.0.113.10 to any port 22 proto tcp
• sudo ufw allow 80/tcp
• sudo ufw allow 443/tcp
• sudo ufw logging on
• sudo ufw enable
• sudo ufw status verbose

In this configuration, SSH is not open to everyone, the two necessary ports for web traffic are open, and the database is closed off. On the WordPress side, security plugins, a strong admin password, updated themes and plugins, regular backups, and SSL create a solid foundation. Correct configuration of domain management and DNS records is also crucial for accessibility Domain Lookup.

Common Mistakes and Troubleshooting Recommendations

SSH Connection Dropped When UFW is Enabled

This usually occurs when UFW is enabled without allowing the SSH port. If you have console access from the provider's panel, connect and add permission with sudo ufw allow 22/tcp or the specific port you are using. If there is no console access, you may need to contact the support team. Therefore, always add the SSH rule before enabling UFW.

Website Not Loading

Even if Nginx or Apache is running, if ports 80 and 443 are closed, the site cannot be accessed. Check the ports with sudo ufw status verbose. Also, verify the port the web server is listening on with the command ss -tulpn. Ensure that DNS records are correctly pointing as well DNS Management.

Email Services Not Working

Email servers use multiple ports for SMTP, IMAP, POP3, and their secure variants. Ports like 25, 465, 587, 993, and 995 may be needed depending on the scenario. If you are using a mail hosting service, you may not need to open these ports on your server Corporate Email Hosting.

Added Rule but No Effect

Incorrect protocol, wrong port, Docker effects, cloud security groups, or the application listening on a different port can cause this. The UFW rule manages filtering at the network layer; if the application is not running, it will not provide service even if the port is open. Therefore, the firewall, service status, and provider network rules should be checked together.

Best UFW Security Practices for 2026

Current server security goes beyond just closing a few ports. A good UFW configuration in 2026 should be supported by the following principles:

• Least privilege: Only open ports that are truly necessary.
• Authentication security: Use key-based access for SSH.
• IP restrictions: Keep management ports behind fixed IP or VPN.
• Observability: Regularly monitor UFW logs and system logs.
• Backup plan: Have console access or recovery procedures in place for faulty firewall rules.
• Layered security: Use UFW alongside WAF, SSL, updates, backups, and application security.
• Documentation: Keep records within the team of why each rule was added.

A well-configured firewall is a complementary part of a performance-oriented and reliable hosting infrastructure. As your project's traffic grows, not only port rules but also resource utilization, backups, CDN, SSL, and monitoring solutions should be planned together Hosting Packages.

Frequently Asked Questions

Does enabling UFW make my server completely secure?

No. UFW reduces the attack surface and provides an important layer of security by closing unnecessary ports; however, it is not sufficient on its own. It should be used in conjunction with updates, SSH keys, strong passwords, SSL, backups, and application security.

Are opening ports 80 and 443 sufficient with UFW?

For a website, ports 80 and 443 are generally sufficient. However, you also need to securely open port 22 or your custom SSH port for management. Database and management panel ports should be IP-restricted if possible.

Does changing the SSH port increase security?

Changing the SSH port can reduce automated bot attempts; however, it should not be seen as a true security measure. A stronger approach involves using SSH keys, disabling password login, applying IP restrictions, and utilizing UFW limit or fail2ban.

Do UFW rules also control Docker containers?

They may not always behave as expected. Docker can directly change iptables rules while publishing ports. Therefore, in servers using Docker, the docker ps output, published ports, and UFW rules should be checked together.

Should I check IPv6 settings when using UFW?

Yes. If your server receives an IPv6 address, you should ensure that UFW is also managing IPv6 traffic. The IPV6=yes setting should be checked in the /etc/default/ufw file, and v6 rules should be verified in the UFW status output.

In summary, firewall management with UFW on Linux servers can be done quickly, readably, and effectively. With the right starting rules, SSH security, controlled opening of web ports, and log monitoring, you can significantly reduce your server's attack surface. If you are launching a new project, planning a secure hosting infrastructure, SSL, and regular maintenance steps together will yield healthier long-term results. You can explore Hostragons solutions to choose the infrastructure suitable for your needs and gradually develop your security configuration according to your growth targets.