{"id":1365,"date":"2026-09-03T11:37:19","date_gmt":"2026-09-03T06:07:19","guid":{"rendered":"https:\/\/cpanelfree.com\/blog\/how-to-configure-ufw-firewall-ubuntu\/"},"modified":"2026-09-03T12:32:44","modified_gmt":"2026-09-03T07:02:44","slug":"how-to-configure-ufw-firewall-ubuntu","status":"publish","type":"post","link":"https:\/\/cpanelfree.com\/blog\/how-to-configure-ufw-firewall-ubuntu\/","title":{"rendered":"How to Configure UFW Firewall on Ubuntu Server (Rules, Ports & Best Practices)"},"content":{"rendered":"
\n

\n Quick Answer:<\/strong> To secure an Ubuntu VPS using UFW (Uncomplicated Firewall), set the default policy to deny incoming traffic (sudo ufw default deny incoming<\/code>), allow your SSH port (sudo ufw allow 22\/tcp<\/code> or sudo ufw limit ssh<\/code>), allow HTTP\/HTTPS (sudo ufw allow 'Nginx Full'<\/code>), and enable the firewall with sudo ufw enable<\/code>.\n <\/p>\n<\/div>\n

What is UFW and Why Every Linux VPS Needs It<\/h2>\n

UFW (Uncomplicated Firewall)<\/strong> is the default frontend for managing netfilter\/iptables firewall rules in Ubuntu and Debian systems. By default, fresh Linux servers expose all bound service ports to the public internet, leaving internal services (like Redis on port 6379, MySQL on port 3306, and debug listeners) vulnerable to port scans and automated exploits.<\/p>\n

Enabling a stateful firewall ensures that only explicitly permitted web and administrative ports accept incoming TCP\/UDP connections.<\/p>\n

Step 1: Setting Default Firewall Policies<\/h2>\n

Before allowing specific services, define the baseline inbound and outbound rules:<\/p>\n

# Deny all unsolicited incoming connections\nsudo ufw default deny incoming\n\n# Allow all outbound server connections\nsudo ufw default allow outgoing<\/pre>\n
Step 2: Allowing SSH Access (Prevent Lockout!)<\/h2>\n
Critical Warning:<\/strong> Never enable UFW without explicitly allowing your SSH management port first, otherwise your active session will be terminated upon activation.<\/p>\n
# Allow standard SSH port 22\nsudo ufw allow 22\/tcp\n\n# RECOMMENDED: Rate-limit SSH to block brute-force bots\nsudo ufw limit 22\/tcp\n\n# If you use a custom SSH port (e.g., 22022)\nsudo ufw allow 22022\/tcp<\/pre>\n
Step 3: Opening Web Server & Control Panel Ports<\/h2>\n
Open the standard networking ports required for web hosting, SSL encryption, and control panel management:<\/p>\n
# Open HTTP (Port 80) and HTTPS (Port 443)\nsudo ufw allow 80\/tcp\nsudo ufw allow 443\/tcp\n\n# Optional: Open Control Panel Web GUIs\n# CyberPanel Port 8090\nsudo ufw allow 8090\/tcp\n\n# aaPanel Port 7800 \/ 8888\nsudo ufw allow 7800\/tcp\n\n# FastPanel Port 8888\nsudo ufw allow 8888\/tcp<\/pre>\n
Step 4: Enabling and Verifying UFW Status<\/h2>\n
Enable the firewall service and verify the active rule table:<\/p>\n
# Enable firewall on boot\nsudo ufw enable\n\n# Inspect numbered active rules\nsudo ufw status numbered<\/pre>\n
Advanced UFW Management: IP Whitelisting & Rule Deletion<\/h2>\n
To restrict database or admin panel access to your specific office static IP address:<\/p>\n
# Allow only your static IP to access MySQL on port 3306\nsudo ufw allow from 203.0.113.50 to any port 3306 proto tcp\n\n# Delete an obsolete rule by its rule number\nsudo ufw delete 4<\/pre>\n
Advanced UFW Port Forwarding & NAT Routing Rules<\/h2>\n
If your VPS acts as a gateway or Docker host, you can configure UFW to route traffic from public ports to private container networks using Network Address Translation (NAT). Edit \/etc\/ufw\/before.rules<\/code> to add nat table forwarding:<\/p>\n
# NAT table rules for Docker container routing\n*nat\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n-A PREROUTING -p tcp --dport 8443 -j REDIRECT --to-ports 443\nCOMMIT<\/pre>\n
Analyzing UFW Log Files for Port Scans and Intrusion Attempts<\/h2>\n
UFW logs all dropped packets directly to \/var\/log\/ufw.log<\/code>. You can inspect this log in real time to identify rogue IP addresses scanning your server for unpatched vulnerabilities:<\/p>\n
# Monitor blocked connection attempts live\nsudo tail -f \/var\/log\/ufw.log | grep '[UFW BLOCK]'\n\n# Count top 10 attacker IPs attempting unauthorized connections\nsudo grep '[UFW BLOCK]' \/var\/log\/ufw.log | awk '{print $12}' | sort | uniq -c | sort -nr | head -n 10<\/pre>\n
Comprehensive UFW Command Reference Cheat Sheet<\/h2>\n
Keep this production command reference handy when managing firewall rules on Ubuntu servers:<\/p>\n\n\n\n\n\n\n\n\n\n
Command<\/th>\nAction & Purpose<\/th>\n<\/tr>\n<\/thead>\n
sudo ufw status verbose<\/code><\/td>\nDisplay complete firewall status, default policies, and logging level<\/td>\n<\/tr>\n
sudo ufw allow 22\/tcp<\/code><\/td>\nAllow incoming TCP traffic on standard SSH port 22<\/td>\n<\/tr>\n
sudo ufw deny 3306\/tcp<\/code><\/td>\nExplicitly block public internet access to MySQL database port<\/td>\n<\/tr>\n
sudo ufw allow from 192.168.1.0\/24<\/code><\/td>\nAllow all connections originating from a private subnet range<\/td>\n<\/tr>\n
sudo ufw reset<\/code><\/td>\nReset all UFW rules back to factory default disabled state<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Protecting Internal Databases and Docker Services from Exposure<\/h2>\n
A frequent security misconfiguration occurs when installing Docker on Linux. By default, Docker modifies iptables<\/code> directly and bypasses UFW rules, inadvertently exposing published container ports (such as Redis on port 6379 or MongoDB on port 27017) to the public internet.<\/p>\n
To ensure Docker respects your firewall restrictions, always bind container port publications to local loopback 127.0.0.1<\/code> (e.g. -p 127.0.0.1:6379:6379<\/code>) or configure the Docker daemon with \"iptables\": false<\/code> in \/etc\/docker\/daemon.json<\/code>.<\/p>\n
\n
\n        \ud83d\udd17<\/span> Recommended Related Technical Guides:
\n    <\/h3>\n