UFW Commands

Status and Enable

Allow SSH before you enable, every time. A default deny with no SSH rule drops your next login, which shows up as a timeout in PuTTY or ssh (see Network error: Connection timed out). Your current session stays up, so use it to fix the rule.

A safe first setup:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw enable
sudo ufw status verbose

Allow Rules

A port with no protocol opens both TCP and UDP. Service names come from /etc/services, app names from ufw app list. The firewall rule generator writes these for you.

Deny and Reject

deny drops packets silently, so the client waits until it times out. reject sends a refusal back, so the client fails at once with "connection refused". Deny is the usual choice for the internet, reject is kinder on internal networks.

Deny rules only work when they sit above the allow rule they override; see Rule Order below.

Allow From an IP or Subnet

from rules and plain port rules combine. Allowing 22 from a subnet and then also allow 22/tcp opens it to everyone, so check status after each change.

Delete Rules

Numbers renumber after each delete. To remove rules 2, 5, and 7, delete 7 first, then 5, then 2.

Rule Order and Insert

ufw evaluates rules top to bottom and the first match wins. A deny from added after allow 22/tcp never fires for port 22, because the allow already matched.

With IPv6 on, an insert position counts IPv4 and IPv6 rules together; ufw refuses a position that would split them and tells you so.

Default Policies

Defaults apply to anything no rule matches. The normal shape is deny in, allow out.

Rate Limiting

limit allows a port but blocks an address that opens 6 or more connections within 30 seconds. It is the cheapest brute-force defence for SSH, and it costs nothing when you also use keys.

A limit rule replaces the allow rule for that port; you do not need both. For anything beyond 6 hits per 30 seconds, use fail2ban.

Logging

App Profiles

Packages such as OpenSSH, nginx, Apache, and Samba drop a profile in /etc/ufw/applications.d/ that names their ports. Rules made from a profile update when the package updates.

A profile of your own goes in /etc/ufw/applications.d/myapp:

[MyApp]
title=My App
description=Internal API
ports=8080,8443/tcp

Reload and Reset

Rules added with allow, deny, and limit apply immediately; no reload needed. The files, if you ever need them:

Anything ufw's syntax cannot express (NAT, port forwarding, DOCKER-USER filtering) goes in before.rules or after.rules as raw iptables. The iptables to nftables converter helps if you are moving that block elsewhere.

Docker

Docker bypasses ufw. It writes its own iptables rules to publish ports, and traffic to a container goes through the FORWARD chain, not INPUT, so a -p 8080:80 container is open to the world even with default deny incoming. ufw status will not show it.

Docker Desktop and rootless Docker do not publish through iptables this way, so the problem is specific to the standard Linux engine. Full container commands are on the Docker cheat sheet.

IPv6

ufw handles IPv6 when IPV6=yes is set in /etc/default/ufw, which is the default on Ubuntu. With it on, every rule you add applies to both stacks and status lists each rule twice, the second marked (v6).

If the server has an IPv6 address and IPV6=no, that address has no firewall at all.

Gotchas

• Enabling without an SSH rule is the classic lockout. sudo ufw allow OpenSSH first, then sudo ufw enable. If it already happened and the provider has a web console, disable ufw from there; a reject policy shows as connection refused, a deny policy as a timeout.
• allow 22 opens TCP and UDP. Nothing listens on UDP 22, so it is harmless, but allow 22/tcp is what you meant.
• Docker ignores ufw. See the Docker section; ufw status saying only 22 is open does not mean 8080 is closed.
• First match wins. A deny from added after a matching allow does nothing; use insert 1 for blocks.
• ufw disable keeps your rules and ufw reset deletes them. ufw status says inactive in both cases; ufw show added tells them apart.
• ufw on a distribution that uses firewalld (Rocky, Fedora) or on a box with a cloud provider firewall in front is a second layer. Two firewalls with different rules is the usual reason a port that ufw says is open still times out.
• Editing /etc/ufw/user.rules by hand gets overwritten by the next ufw command. Use the CLI for rules and the before.rules and after.rules files for the raw iptables ufw cannot express. See the SSH cheat sheet for the ssh side of testing a port after a change.