UFW (Uncomplicated Firewall) is the simplest way to set up a firewall on an Ubuntu server. With a few commands you determine which network traffic is allowed and which isn’t, so that only the ports you need (such as SSH, HTTP, and HTTPS) are open. This article shows you how to install, activate, and configure UFW, including common mistakes that can make a server unreachable.
What is UFW and why use it
A firewall checks incoming and outgoing network traffic based on rules. By default, Ubuntu runs the powerful but complex iptables firewall under the hood. UFW is a user-friendly layer on top of it, specifically designed to make firewall management accessible without having to learn complicated iptables syntax.
Without a firewall, every open port on your server is potentially reachable from the entire internet. By setting up UFW, you limit this to only the services you actually offer, such as web traffic and SSH access. This significantly reduces the attack surface and is one of the first steps in securing a VPS.
Installing UFW and setting basic rules
UFW is already present on most Ubuntu installations, but disabled by default. First install it (if needed) and then set a secure default policy before enabling it.
Install UFW
Run sudo apt update && sudo apt install ufw to install UFW or update it to the latest version.
Set the default policy
Set incoming traffic to deny by default and outgoing to allow with sudo ufw default deny incoming and sudo ufw default allow outgoing.
Allow SSH
Explicitly allow SSH before activating the firewall, otherwise you’ll lock yourself out: sudo ufw allow OpenSSH or sudo ufw allow 22/tcp.
Enable UFW
Enable the firewall with sudo ufw enable and confirm the prompt with y.
sudo ufw allow 2222/tcp) instead of the default OpenSSH rule, otherwise you’ll lock yourself out of the server.Opening and closing ports
After enabling UFW, you need to open the ports your server actually uses. For a web server with Plesk, as used at Tandata, these are usually the ports for HTTP, HTTPS, and the Plesk control panel.
sudo ufw allow 80/tcp— opens HTTP trafficsudo ufw allow 443/tcp— opens HTTPS trafficsudo ufw allow 8443/tcp— opens the Plesk management interfacesudo ufw allow 21/tcp— opens FTP (only if needed)
To close a port again, replace allow with deny or remove the rule with sudo ufw delete allow 80/tcp. To restrict access to a specific IP address, for instance for admin access, use sudo ufw allow from 123.45.67.89 to any port 22.
If you also manage email on the same server, remember the ports for SMTP, IMAP, and POP3. If your business email runs through a separate service such as business email hosting, you don’t need to open these ports on the web server itself.
Managing rules and checking status
It’s important to regularly check which rules are active, especially after making multiple changes. This prevents ports from being accidentally left open.
Use sudo ufw status verbose to get an overview of all active rules, the default policy, and the logging status. With sudo ufw status numbered you see numbered rules, which is handy for removing a specific rule with sudo ufw delete [number].
To enable logging to monitor suspicious traffic, use sudo ufw logging on. You’ll find the logs in /var/log/ufw.log. This is useful if you suspect unwanted connection attempts are taking place.
If you manage a server with Plesk, you can also consult the built-in firewall module in the control panel alongside UFW to manage rules visually. If you’re unsure about the right configuration for your situation, check the knowledge base or contact support.
Frequently Asked Questions
What happens if I enable UFW without allowing SSH?
You immediately lose your SSH connection to the server and can no longer log in remotely. Recovery is then often only possible via your hosting provider’s console access.
Does UFW work together with Plesk?
Yes, but Plesk also has its own firewall module. Make sure both don’t contain conflicting rules, and always check after changes that important services remain reachable.
How do I turn UFW off again?
Use sudo ufw disable. This fully disables the firewall; only use this temporarily for troubleshooting.
Can I open multiple ports at once?
Yes, with a range such as sudo ufw allow 1000:2000/tcp you open all ports within that range at once.
Is UFW sufficient for server security?
A firewall is one layer of security. Combine it with strong passwords, SSH keys, regular updates, and daily backups for a well-secured server.
Conclusion
UFW makes setting up a firewall on Ubuntu straightforward: install it, set a secure default policy, open only the ports you need, and regularly check the active rules. This way, you limit access to your server to exactly what’s needed. Prefer not to manage your own firewall rules and want this outsourced to a provider with fully managed servers? Check out the options to switch to Tandata.