How to Configure a Firewall on a Linux VPS with UFW and iptables: A Practical Guide

A Linux server exposed to the internet without a properly configured firewall is an open invitation for attackers. Whether you're running a WordPress site, a Node.js application, or a mail server, setting up a firewall should be one of the very first things you do after provisioning a NVMe VPS or an SSD VPS.

In this guide you will learn:
- What UFW and iptables are and when to use each
- How to install and enable UFW on Ubuntu/Debian
- Which rules are essential for a web server
- How to use iptables directly for advanced use cases
- Common mistakes and how to avoid them

---

What Is a Linux Firewall and Why Does It Matter?

A firewall is your server's first line of defence. It decides which network traffic is allowed to enter or leave the server, based on rules you define.

On Linux, the underlying engine is netfilter — built into the kernel. Two main tools sit on top of it:

• iptables — the classic interface: powerful but with a steeper learning curve
• UFW (Uncomplicated Firewall) — a front-end for iptables, recommended for everyday use on Ubuntu/Debian

If you have a managed dedicated server, the administration team can handle these configurations for you. If you manage your server yourself, keep reading.

---

Installing and Configuring UFW

1. Check Whether UFW Is Installed

On Ubuntu 20.04/22.04 and Debian 11/12, UFW comes pre-installed. Check the status:

sudo ufw status verbose

If it's not installed:

sudo apt update && sudo apt install ufw -y

2. Set the Default Policies

Before enabling UFW, define the baseline behaviour: deny all incoming, allow all outgoing.

sudo ufw default deny incoming
sudo ufw default allow outgoing

This is the "zero trust" principle applied at the network level — nothing gets in unless explicitly allowed.

3. Allow SSH — Mandatory Before Enabling UFW!

⚠️ Warning: If you enable UFW without allowing SSH first, you will lock yourself out of your own server!

sudo ufw allow 22/tcp

If you changed the SSH port (recommended — e.g., port 2222):

sudo ufw allow 2222/tcp

4. Enable UFW

sudo ufw enable

You'll receive a warning that existing connections may be disrupted. Confirm with y.

---

Essential Rules for a Web Server

If you host a website on a WordPress VPS hosting plan or run Nginx/Apache, open the HTTP and HTTPS ports:

sudo ufw allow 80/tcp    # HTTP
sudo ufw allow 443/tcp   # HTTPS

Or use the application profile shortcut:

sudo ufw allow 'Nginx Full'
# or
sudo ufw allow 'Apache Full'

Rules for Additional Services

Service	UFW Command
MySQL (local only)	sudo ufw deny 3306
MySQL (specific IP)	sudo ufw allow from 192.168.1.100 to any port 3306
Passive FTP	sudo ufw allow 21/tcp
Email SMTP	sudo ufw allow 25/tcp
Email IMAPS	sudo ufw allow 993/tcp

Restrict SSH to a Specific IP

If you want to allow SSH only from a specific IP address (e.g., your office):

sudo ufw allow from 89.34.56.78 to any port 22
sudo ufw delete allow 22/tcp

This approach is extremely effective against brute-force attacks.

---

Managing UFW Rules

List Rules with Line Numbers

sudo ufw status numbered

Sample output:

Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 2] 80/tcp                     ALLOW IN    Anywhere
[ 3] 443/tcp                    ALLOW IN    Anywhere

Delete a Rule by Number

sudo ufw delete 3

Reset All Rules

sudo ufw reset

Warning: this command disables UFW and deletes all rules!

---

Introduction to iptables — For Advanced Scenarios

UFW is sufficient for most servers, but iptables gives you granular control. This is especially useful when managing an unmanaged dedicated server with complex networking requirements.

How iptables Is Structured

iptables works with tables, chains, and rules:
- Main tables: filter, nat, mangle
- Chains: INPUT, OUTPUT, FORWARD

Basic Commands

View current rules:

sudo iptables -L -v -n

Block a suspicious IP:

sudo iptables -A INPUT -s 45.67.89.123 -j DROP

Allow port 443:

sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Limit ICMP flood (ping protection):

sudo iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
sudo iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

Save iptables Rules

iptables rules are not persistent across reboots by default! To save them:

sudo apt install iptables-persistent -y
sudo netfilter-persistent save

---

UFW vs. iptables: Which Should You Choose?

Criterion	UFW	iptables
Ease of use	✅ Very simple	⚠️ Complex syntax
Granular control	⚠️ Limited	✅ Maximum
Best for	Simple VPS, websites	Complex servers, routers
Automatic persistence	✅ Yes	❌ Requires extra setup

For a single-vCore VPS running a blog or an online store, UFW is more than enough.

---

Common Mistakes to Avoid

1. Enabling UFW before allowing SSH — you'll lock yourself out
2. Leaving MySQL port 3306 open to the world — major unauthorized access risk
3. Not saving iptables rules — after a reboot, your server is unprotected
4. Using ufw allow from any broadly — negates the entire purpose of a firewall
5. Forgetting IPv6 — make sure /etc/default/ufw contains IPV6=yes

---

Testing Your Firewall Configuration

After configuration, test from an external machine using nmap:

nmap -sV -p 22,80,443,3306 YOUR_SERVER_IP

Unwanted ports should appear as filtered or closed — never open.

You can also use the online tool Shields Up by GRC for a quick browser-based check.

---

Conclusion

Configuring a firewall correctly is a responsibility you can't afford to delay. UFW offers a fast and reliable solution for the most common scenarios, while iptables provides maximum flexibility for advanced configurations.

If you'd rather focus on your project and leave server administration to experienced professionals, explore server management services from CLIQHOST — security hardening, monitoring, and performance optimization all included.

Have questions about configuring your server? Contact our team — we're here to help.