UFW Commands

Status and Enable

Allow SSH before you enable, every time. See SSH Lockout below for the order and the way out.

A safe first setup:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw enable
sudo ufw status verbose

SSH Lockout

ufw enable puts default deny incoming into force the moment you run it. The session you are typing in survives, because connection tracking counts it as established, but the next login is dropped unless a rule already allows the port. Add the SSH rule first and enable last.

sudo ufw allow OpenSSH          # or: sudo ufw allow 22/tcp
sudo ufw show added             # check the rule is there while ufw is still off
sudo ufw enable

Cancel the deadman switch once the new login works. If sshd listens on a non-standard port, allow that port instead and check it from outside with the SSH port checker. A deny default shows up as a timeout (Network error: Connection timed out), a reject default as connection refused.

Allow Rules

A port with no protocol opens both TCP and UDP. Service names come from /etc/services, app names from ufw app list. The firewall rule generator writes these for you.

Deny and Reject

deny drops packets silently, so the client waits until it times out. reject sends a refusal back, so the client fails at once with "connection refused". Deny is the usual choice for the internet, reject is kinder on internal networks.

Deny rules only work when they sit above the allow rule they override; see Rule Order below.

Allow From an IP or Subnet

from rules and plain port rules combine. Allowing 22 from a subnet and then also allow 22/tcp opens it to everyone, so check status after each change.

Delete Rules

Numbers renumber after each delete. To remove rules 2, 5, and 7, delete 7 first, then 5, then 2. With IPv6 on, every rule appears twice in status numbered, once plain and once marked (v6), and each copy carries its own number.

Rule Order and Insert

ufw evaluates rules top to bottom and the first match wins. A deny from added after allow 22/tcp never fires for port 22, because the allow already matched.

With IPv6 on, an insert position counts IPv4 and IPv6 rules together; ufw refuses a position that would split them and tells you so.

Default Policies

Defaults apply to anything no rule matches. The normal shape is deny in, allow out.

Rate Limiting

limit allows a port but blocks an address that opens 6 or more connections within 30 seconds. It is the cheapest brute-force defence for SSH, and it costs nothing when you also use keys.

A limit rule replaces the allow rule for that port; you do not need both. For anything beyond 6 hits per 30 seconds, use fail2ban.

Logging

App Profiles

Packages such as OpenSSH, nginx, Apache, and Samba drop a profile in /etc/ufw/applications.d/ that names their ports. Rules made from a profile update when the package updates.

A profile of your own goes in /etc/ufw/applications.d/myapp:

[MyApp]
title=My App
description=Internal API
ports=8080,8443/tcp

Ping and ICMP

ufw's rule syntax has no ICMP protocol, so sudo ufw allow proto icmp fails with ERROR: Unsupported protocol 'icmp'. Ping is accepted in /etc/ufw/before.rules before your own rules run, and changing that means editing the file.

To stop answering ping, change ACCEPT to DROP on the echo-request line in /etc/ufw/before.rules, and in before6.rules for IPv6:

-A ufw-before-input -p icmp --icmp-type echo-request -j DROP

Leave the other ICMP types accepted. destination-unreachable carries path MTU discovery, and dropping it breaks large packets over some links.

Port Forwarding and NAT

The ufw CLI covers the INPUT chain. Forwarded traffic needs route rules, IP forwarding turned on, and a NAT block written by hand.

A DNAT port forward goes at the top of /etc/ufw/before.rules, above the *filter line:

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 10.0.0.5:8080
-A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
COMMIT

Then sudo ufw reload, and add a matching ufw route allow rule, because the rewritten packet still has to pass the FORWARD chain. Traffic from the server itself never goes through PREROUTING, so testing a forward from the box always fails; test from another host or with the SSH port checker.

Reload and Reset

Rules added with allow, deny, and limit apply immediately; no reload needed. The files, if you ever need them:

Anything ufw's syntax cannot express (NAT, port forwarding, DOCKER-USER filtering) goes in before.rules or after.rules as raw iptables. The iptables to nftables converter helps if you are moving that block elsewhere.

Docker

Docker bypasses ufw. It writes its own iptables rules to publish ports, and traffic to a container goes through the FORWARD chain, not INPUT, so a -p 8080:80 container is open to the world even with default deny incoming. ufw status will not show it.

Docker Desktop and rootless Docker do not publish through iptables this way, so the problem is specific to the standard Linux engine. Full container commands are on the Docker cheat sheet.

IPv6

ufw handles IPv6 when IPV6=yes is set in /etc/default/ufw, which is the default on Ubuntu. With it on, every rule you add applies to both stacks and status lists each rule twice, the second marked (v6).

If the server has an IPv6 address and IPV6=no, that address has no firewall at all.

Install

Ubuntu Server ships ufw. Debian, Raspberry Pi OS, and minimal cloud images do not.

Gotchas

• Enabling without an SSH rule is the classic lockout. sudo ufw allow OpenSSH first, then sudo ufw enable. If it already happened and the provider has a web console, disable ufw from there; a reject policy shows as connection refused, a deny policy as a timeout.
• allow 22 opens TCP and UDP. Nothing listens on UDP 22, so it is harmless, but allow 22/tcp is what you meant.
• Docker ignores ufw. See the Docker section; ufw status saying only 22 is open does not mean 8080 is closed.
• First match wins. A deny from added after a matching allow does nothing; use insert 1 for blocks.
• ufw disable keeps your rules and ufw reset deletes them. ufw status says inactive in both cases; ufw show added tells them apart.
• ufw: command not found means the package is missing (Debian and minimal images) or you left off sudo, since /usr/sbin is not on a normal user's PATH.
• Inactive again after a reboot happens on Arch and on images where the systemd unit was never enabled. sudo systemctl enable ufw fixes it; on Ubuntu, ufw enable already does.
• ICMP is not expressible in a ufw rule. Ping is allowed in before.rules, so default deny incoming does not stop it.
• ufw on a distribution that uses firewalld (Rocky, Fedora) or on a box with a cloud provider firewall in front is a second layer. Two firewalls with different rules is the usual reason a port that ufw says is open still times out.
• Editing /etc/ufw/user.rules by hand gets overwritten by the next ufw command. Use the CLI for rules and the before.rules and after.rules files for the raw iptables ufw cannot express. See the SSH cheat sheet for the ssh side of testing a port after a change.