Installing UFW as a firewall
Posted: Fri Sep 11, 2026 2:19 am
It’s important to have a firewall set up on any computer. It helps protect against unwanted connections from the internet.
UFW is a firewall often used on Linux distributions; usually running as a default firewall. UFW is a front end for iptables and is easy to use when you are first learning about firewalls. UFW is great if you are looking for something that you can quickly set up, are running a standard VPS environment, and a personal server, or just looking for simple day-to-day port management.
However, because of it’s simplicity, it isn’t as good as something like iptables. Iptables is more advanced than UFW because it is more customizable. This customization allows for greater fine tuning of rules. When you learn iptable rules, you can always switch if you want that extra control.
For now, this is how to set up UFW on Linux.
Before we get started, remember to update your system:
$sudo apt update && sudo apt full-upgrade && sudo apt clean && sudo apt autoremove
Now that we are fully upgraded, we can check if UFW is installed:
$sudo ufw status verbose
If you get any output, you have it installed and running. If there is no output, install it by:
$sudo apt install ufw
Also, go ahead and make sure that it is enabled:
$sudo ufw enable
NOTE: After you enable UFW and start adding/deleting rules, you may get a message that you need to reload UFW to enable the rules, Just run:
$sudo ufw reload
One thing to consider is if you want UFW to use both IPV4 and IPV6 or if you want to disable IPV6. You can do this by editing /etc/default/ufw and look for the line IPV6 =. If you want it enabled, use IPV6 = yes; to disable change it to IPV6 = no.
By default, UFW usually denies all incoming connections and allows all outbound connections to the server. But we can make sure by using the following commands:
$sudo ufw default deny incoming
$sudo ufw default allow outgoing
You can also open any ports that you need. You will have to know the port that the service uses to apply the rule. Opening ports for SSH, Apache, and mail are the most common ports.
Here are some examples of how to open a port, I will use SSH and apache as examples:
$sudo ufw allow http
$sudo ufw allow https
$sudo ufw allow openssh
Instead of running two commands to open http and https, you can open both ports with one command:
$sudo ufw apache full
This opens port 80 for http, port 443 for https, and port 22 for ssh.
Sometimes you may want to restrict a port connection to an IP or a LAN range of Ips. This can be done by changing how you enable the rule. Here are examples of how to limit SSH
$sudo ufw allow from 192.168.x.x to any app openssh [allows connections to ssh from local ip]
$sudo ufw allow from 192.168.0.1/24 to any app openssh [allows connections from your local network]
$sudo ufw allow from x.x.x.x to any app openssh 22 [allows connections from public ip]
If you want to delete rules, the easiest way is to list the rules by number and then delete:
$sudo ufw status numbered
$sudo ufw delete [number]
If for some reason, you want to delete and reset all the UFW rules:
$sudo ufw reset
Sometimes for security reasons, you will want to have UFW logging:
$sudo ufw logging on
That’s all there is to get UFW up and running.
UFW is a firewall often used on Linux distributions; usually running as a default firewall. UFW is a front end for iptables and is easy to use when you are first learning about firewalls. UFW is great if you are looking for something that you can quickly set up, are running a standard VPS environment, and a personal server, or just looking for simple day-to-day port management.
However, because of it’s simplicity, it isn’t as good as something like iptables. Iptables is more advanced than UFW because it is more customizable. This customization allows for greater fine tuning of rules. When you learn iptable rules, you can always switch if you want that extra control.
For now, this is how to set up UFW on Linux.
Before we get started, remember to update your system:
$sudo apt update && sudo apt full-upgrade && sudo apt clean && sudo apt autoremove
Now that we are fully upgraded, we can check if UFW is installed:
$sudo ufw status verbose
If you get any output, you have it installed and running. If there is no output, install it by:
$sudo apt install ufw
Also, go ahead and make sure that it is enabled:
$sudo ufw enable
NOTE: After you enable UFW and start adding/deleting rules, you may get a message that you need to reload UFW to enable the rules, Just run:
$sudo ufw reload
One thing to consider is if you want UFW to use both IPV4 and IPV6 or if you want to disable IPV6. You can do this by editing /etc/default/ufw and look for the line IPV6 =. If you want it enabled, use IPV6 = yes; to disable change it to IPV6 = no.
By default, UFW usually denies all incoming connections and allows all outbound connections to the server. But we can make sure by using the following commands:
$sudo ufw default deny incoming
$sudo ufw default allow outgoing
You can also open any ports that you need. You will have to know the port that the service uses to apply the rule. Opening ports for SSH, Apache, and mail are the most common ports.
Here are some examples of how to open a port, I will use SSH and apache as examples:
$sudo ufw allow http
$sudo ufw allow https
$sudo ufw allow openssh
Instead of running two commands to open http and https, you can open both ports with one command:
$sudo ufw apache full
This opens port 80 for http, port 443 for https, and port 22 for ssh.
Sometimes you may want to restrict a port connection to an IP or a LAN range of Ips. This can be done by changing how you enable the rule. Here are examples of how to limit SSH
$sudo ufw allow from 192.168.x.x to any app openssh [allows connections to ssh from local ip]
$sudo ufw allow from 192.168.0.1/24 to any app openssh [allows connections from your local network]
$sudo ufw allow from x.x.x.x to any app openssh 22 [allows connections from public ip]
If you want to delete rules, the easiest way is to list the rules by number and then delete:
$sudo ufw status numbered
$sudo ufw delete [number]
If for some reason, you want to delete and reset all the UFW rules:
$sudo ufw reset
Sometimes for security reasons, you will want to have UFW logging:
$sudo ufw logging on
That’s all there is to get UFW up and running.