Configure a firewall with UFW

A firewall decides which network doors on your server are open. UFW (Uncomplicated Firewall) is a friendly front end to Linux's built-in firewall. The approach is simple: block all incoming traffic by default, then open only the ports your services need.

Before you begin

• A sudo-enabled user, logged in over SSH. See the sudo user guide if you need one.
• A list of the services you plan to run and their ports. SSH uses port 22, web traffic uses 80 (HTTP) and 443 (HTTPS), and a Minecraft server defaults to 25565.
• A second terminal window open, so you have a way back in if a rule goes wrong.

Step 1: Check the current firewall state

Confirm that UFW is installed and see whether it is already running. Ubuntu server images normally include it. The status verbose option shows the default policies as well as the rules:

sudo ufw status verbose

Status: inactive

Step 2: Set the default policies

The default policy applies to any traffic that no rule matches. Blocking incoming traffic and allowing outgoing traffic is the standard safe choice. Outgoing traffic is what lets your server download updates and reach other services:

sudo ufw default deny incoming
sudo ufw default allow outgoing

Step 3: Allow SSH before you enable the firewall

This is the most important step. If you enable UFW without allowing SSH, your own connection can be cut off immediately. The OpenSSH profile opens port 22 for SSH:

sudo ufw allow OpenSSH

If you later move SSH to a different port, allow that port instead, for example sudo ufw allow 2222/tcp, before changing anything else.

Step 4: Allow your web and game ports

Open only the ports for services you actually run. For a web server, allow both HTTP and HTTPS. The /tcp suffix limits each rule to TCP traffic, which is what web and most game servers use:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Only open the ports you need. Each open port is one more way in.

Step 5: Turn the firewall on

Enable UFW. It warns that the command may disrupt existing SSH connections. Because you allowed SSH in Step 3, type y and press Enter:

sudo ufw enable

Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup

Step 6: Verify the rules

List the active rules, with numbers so you can refer to them later:

sudo ufw status verbose
sudo ufw status numbered

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere
22/tcp (v6)                ALLOW IN    Anywhere (v6)

Step 7: Restrict access and remove rules

You can allow SSH from only your own address. Replace the example address with yours, which you can find by searching for "what is my IP address" in a browser:

sudo ufw allow from 198.51.100.7 to any port 22 proto tcp

To remove a rule, use its number from status numbered. For example, sudo ufw delete 4 removes rule 4. Be careful with the numbers, because they shift after each deletion.

Troubleshooting

• You locked yourself out. Use any browser-based console your provider offers for the server, or contact LightServe support via chat or email. Then allow SSH with sudo ufw allow OpenSSH.
• A website does not load even though port 80 is allowed. The firewall is not the only possible cause. Check that a service is listening with sudo ss -tlnp. If nothing is listed on port 80, start your web server.
• A rule seems to have no effect. Confirm the rule is listed with sudo ufw status verbose, and check that you did not mistype the port number or protocol.
• You want to turn the firewall off temporarily. Run sudo ufw disable, then sudo ufw enable when you are ready. Disabling removes protection, so do it only briefly.

Next steps

Next, add Fail2ban to block repeated failed logins. Combined with this firewall, it keeps unwanted traffic off your server.