October 14, 2026 · by Alex M.
A server exposed to the internet without a properly configured firewall is an open invitation for attackers. UFW (Uncomplicated Firewall) is the default firewall management tool on Ubuntu and Debian, and it's the simplest way to control network traffic on a Linux VPS — without needing deep knowledge of iptables.
In this complete guide, you'll learn how to install, configure, and manage UFW on a VPS running Ubuntu 22.04, with practical examples covering real-world scenarios: web server, SSH, email, databases, and advanced configurations.
UFW is a simplified front-end for iptables, the packet filtering engine built into the Linux kernel. Instead of writing complex iptables rules by hand, UFW lets you define clear policies with intuitive commands.
Whether you're running a NVMe VPS or a managed dedicated server, UFW should be one of the first things you configure right after setting up your operating system.
EN
RO — Română
RU — Русский
sudo privileges⚠️ Critical warning: Always allow SSH access before enabling UFW. If you lock yourself out, you'll need VNC/KVM console access to recover.
UFW is usually pre-installed on Ubuntu 22.04. Check its status:
sudo ufw status
If it's not installed:
sudo apt update && sudo apt install ufw -y
Verify the version:
ufw --version
Before enabling UFW, configure the baseline policy: block all incoming traffic and allow all outgoing traffic.
sudo ufw default deny incoming
sudo ufw default allow outgoing
This "deny by default" approach is the most secure starting point: everything not explicitly allowed will be blocked.
Add an SSH rule before enabling the firewall:
sudo ufw allow ssh
If you use a custom SSH port (e.g., 2222):
sudo ufw allow 2222/tcp
List available application profiles:
sudo ufw app list
Allow SSH via profile:
sudo ufw allow OpenSSH
With SSH allowed, activate the firewall:
sudo ufw enable
Type y to confirm. Check the status:
sudo ufw status verbose
Example output:
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
To Action From
-- ------ ----
22/tcp ALLOW IN Anywhere
22/tcp (v6) ALLOW IN Anywhere (v6)
If you're hosting a website on a VPS with Nginx or Apache, you need HTTP and HTTPS ports open:
sudo ufw allow 'Nginx Full'
This profile opens ports 80 (HTTP) and 443 (HTTPS) simultaneously.
Or manually:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 'Apache Full'
sudo ufw allow 'Nginx HTTPS'
If you need an SSL certificate for your server, CLIQHOST SSL certificates cover everything from DV to wildcard options.
Never expose a database port to the open internet! Restrict access to specific trusted IP addresses only.
sudo ufw allow from 192.168.1.50 to any port 3306
sudo ufw allow from 10.0.0.0/8 to any port 5432
sudo ufw allow from 10.10.0.5 to any port 6379
If you run a mail server (e.g., Postfix), open the necessary ports:
sudo ufw allow 25/tcp # SMTP
sudo ufw allow 587/tcp # SMTP submission
sudo ufw allow 465/tcp # SMTPS
sudo ufw allow 143/tcp # IMAP
sudo ufw allow 993/tcp # IMAPS
sudo ufw allow 110/tcp # POP3
sudo ufw allow 995/tcp # POP3S
Note: Port 25 is often blocked by hosting providers to prevent spam. Check with CLIQHOST server management services if you need full SMTP access.
UFW has a native rate-limiting feature that works perfectly against SSH brute-force attacks:
sudo ufw limit ssh
This rule automatically blocks any IP that attempts more than 6 connections within 30 seconds. It complements Fail2Ban and is much simpler to configure.
Rate limiting on a custom port:
sudo ufw limit 2222/tcp comment 'Custom SSH port'
sudo ufw allow from 203.0.113.10
sudo ufw allow from 203.0.113.10 to any port 443
sudo ufw deny from 198.51.100.0/24
sudo ufw deny from 198.51.100.5 to any port 80
sudo ufw status numbered
Example output:
To Action From
-- ------ ----
[ 1] 22/tcp ALLOW IN Anywhere
[ 2] 80/tcp ALLOW IN Anywhere
[ 3] 443/tcp ALLOW IN Anywhere
[ 4] 3306/tcp ALLOW IN 192.168.1.50
sudo ufw delete 4
sudo ufw delete allow 80/tcp
sudo ufw disable
sudo ufw reset
sudo ufw logging on
Available levels: off, low, medium, high, full
sudo ufw logging medium
View logs:
tail -f /var/log/ufw.log
Or via journald:
journalctl -f | grep UFW
For long-term log management, combine UFW logging with logrotate to prevent your disk from filling up with old log files. Check the CLIQHOST blog for more Linux server management tips.
For complex scenarios (NAT, packet forwarding), edit configuration files directly:
sudo nano /etc/ufw/before.rules
General UFW configuration:
sudo nano /etc/ufw/ufw.conf
After making changes, reload rules:
sudo ufw reload
Verify that IPv6 is enabled in /etc/ufw/ufw.conf:
IPV6=yes
With this option active, all defined rules automatically apply to IPv6 traffic as well.
Here's the full command sequence for a VPS web hosting environment:
# Default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing
# SSH with brute-force protection
sudo ufw limit ssh
# Web traffic
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
# Database — only from the app server
sudo ufw allow from 10.0.0.5 to any port 3306
# Enable
sudo ufw enable
# Verify
sudo ufw status verbose
If you forgot to add the SSH rule before ufw enable, you'll need VNC/KVM console access. CLIQHOST provides emergency console access for exactly these situations — reach out to support immediately.
Check the rule order (ufw status numbered). UFW applies rules sequentially — the first matching rule wins.
Make sure the service is enabled:
sudo systemctl enable ufw
sudo systemctl start ufw
Docker modifies iptables rules directly, bypassing UFW. The solution is to configure the DOCKER-USER chain or edit /etc/ufw/after.rules. See the CLIQHOST blog for the dedicated Docker + Nginx reverse proxy guide.
UFW is an essential tool for every Linux server administrator — easy to learn, powerful enough for real production environments. Combined with SSH key authentication, Fail2Ban, and regular system updates, UFW forms the foundation of a secure server infrastructure.
If you'd like a Linux VPS that's already configured and secured, or need expert help with server administration, CLIQHOST server management services are here to help. Also explore our NVMe VPS plans — top-tier performance with full technical support included.
Real reviews from customers who trust CLIQHOST for performance, reliability and expert technical support.
"We moved our online shop from a foreign host and the difference is night and day — pages load instantly and support replies in minutes, in Romanian."
"Migrated 12 client sites to CLIQHOST. Free migration, zero downtime, and the cPanel setup is exactly what my team needed. Highly recommend."
"Our NVMe VPS handles traffic spikes without a sweat. Full root, local datacenter, and billing in MDL — everything we wanted from a provider."
