How to Configure UFW Firewall on Ubuntu Server (Rules, Ports & Best Practices)

What is UFW and Why Every Linux VPS Needs It

UFW (Uncomplicated Firewall) is the default frontend for managing netfilter/iptables firewall rules in Ubuntu and Debian systems. By default, fresh Linux servers expose all bound service ports to the public internet, leaving internal services (like Redis on port 6379, MySQL on port 3306, and debug listeners) vulnerable to port scans and automated exploits.

Enabling a stateful firewall ensures that only explicitly permitted web and administrative ports accept incoming TCP/UDP connections.

Step 1: Setting Default Firewall Policies

Before allowing specific services, define the baseline inbound and outbound rules:

# Deny all unsolicited incoming connections
sudo ufw default deny incoming

# Allow all outbound server connections
sudo ufw default allow outgoing

Step 2: Allowing SSH Access (Prevent Lockout!)

Critical Warning: Never enable UFW without explicitly allowing your SSH management port first, otherwise your active session will be terminated upon activation.

# Allow standard SSH port 22
sudo ufw allow 22/tcp

# RECOMMENDED: Rate-limit SSH to block brute-force bots
sudo ufw limit 22/tcp

# If you use a custom SSH port (e.g., 22022)
sudo ufw allow 22022/tcp

Step 3: Opening Web Server & Control Panel Ports

Open the standard networking ports required for web hosting, SSL encryption, and control panel management:

# Open HTTP (Port 80) and HTTPS (Port 443)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Optional: Open Control Panel Web GUIs
# CyberPanel Port 8090
sudo ufw allow 8090/tcp

# aaPanel Port 7800 / 8888
sudo ufw allow 7800/tcp

# FastPanel Port 8888
sudo ufw allow 8888/tcp

Step 4: Enabling and Verifying UFW Status

Enable the firewall service and verify the active rule table:

# Enable firewall on boot
sudo ufw enable

# Inspect numbered active rules
sudo ufw status numbered

Advanced UFW Management: IP Whitelisting & Rule Deletion

To restrict database or admin panel access to your specific office static IP address:

# Allow only your static IP to access MySQL on port 3306
sudo ufw allow from 203.0.113.50 to any port 3306 proto tcp

# Delete an obsolete rule by its rule number
sudo ufw delete 4

Advanced UFW Port Forwarding & NAT Routing Rules

If your VPS acts as a gateway or Docker host, you can configure UFW to route traffic from public ports to private container networks using Network Address Translation (NAT). Edit /etc/ufw/before.rules to add nat table forwarding:

# NAT table rules for Docker container routing
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p tcp --dport 8443 -j REDIRECT --to-ports 443
COMMIT

Analyzing UFW Log Files for Port Scans and Intrusion Attempts

UFW logs all dropped packets directly to /var/log/ufw.log. You can inspect this log in real time to identify rogue IP addresses scanning your server for unpatched vulnerabilities:

# Monitor blocked connection attempts live
sudo tail -f /var/log/ufw.log | grep '[UFW BLOCK]'

# Count top 10 attacker IPs attempting unauthorized connections
sudo grep '[UFW BLOCK]' /var/log/ufw.log | awk '{print $12}' | sort | uniq -c | sort -nr | head -n 10

Comprehensive UFW Command Reference Cheat Sheet

Keep this production command reference handy when managing firewall rules on Ubuntu servers:

Protecting Internal Databases and Docker Services from Exposure

A frequent security misconfiguration occurs when installing Docker on Linux. By default, Docker modifies iptables directly and bypasses UFW rules, inadvertently exposing published container ports (such as Redis on port 6379 or MongoDB on port 27017) to the public internet.

To ensure Docker respects your firewall restrictions, always bind container port publications to local loopback 127.0.0.1 (e.g. -p 127.0.0.1:6379:6379) or configure the Docker daemon with "iptables": false in /etc/docker/daemon.json.

Frequently Asked Questions