How to Configure a Firewall with UFW on Ubuntu 22.04 Server

On Ubuntu 22.04 Server, you can manage incoming and outgoing network traffic using UFW (Uncomplicated Firewall). For remote servers, make sure to allow the SSH port you are currently using before enabling the firewall, and confirm that you can recover access using another terminal or console.

Things to Check Before Getting Started

UFW is a tool for managing Linux firewalls. Even if a port is allowed in the firewall, a connection can only be made if the service is installed, running, and listening on the correct address and port. If there are cloud security groups or external firewalls, check their rules separately as well.

Do not arbitrarily change existing policies on a running server. First, check the current firewall status, registered rules, required services, and access ports, and prepare an access method that can be used even if SSH is disconnected, such as through a cloud console or server management console. Commands require administrator privileges.

sudo ufw status verbose
sudo ufw show added
sudo ss -lntup

status verbose shows the active UFW policies and rules. If UFW is inactive, you cannot check all registered rules with this screen alone, so also refer to show added. ss helps identify listening sockets, but does not establish whether a service is reachable from outside.

Activate after allowing SSH

The following is an example of a new server running SSH on the default TCP port 22. If the port is different, change it to the actual port. This rule allows that port without restricting it to a specific IP, so consider that the access range is wide. On already active servers, review existing rules and priorities first.

sudo ufw allow 22/tcp

Check other required service rules and the default policy, then turn on the firewall. When you turn on UFW, existing SSH connections may be interrupted as the rules are reapplied. Test a new SSH connection from a separate terminal while keeping the current session, and if it fails, access with the prepared console to modify the rules.

sudo ufw enable
sudo ufw status verbose

Verify that the status is active and that the intended SSH rule is displayed. Then, test connections from both allowed and disallowed networks for the actual necessary services. This procedure and exceptions can also be checked in the remote management section of Ubuntu 22.04 UFW documentation.

Basic Policies and Port Rules

The default settings of a newly installed UFW generally deny incoming connections and allow outgoing connections, but this may vary by server. Check the actual policies with status verbose. For example, to deny incoming connections by default on a new server where all required services have been checked, you can use the following command. On a server already in operation, first review how policy changes will affect existing services and connections.

sudo ufw default deny incoming

If you need to provide a web server externally, allow the ports and protocols that are actually used. The following are examples of TCP ports for HTTP and HTTPS, and it is not necessary to apply them universally to servers that do not run web services.

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

If the server provides DNS services, you can allow UDP and TCP on port 53 as needed. Do not open ports on servers that do not provide DNS services just because it is an example.

sudo ufw allow 53/udp
sudo ufw allow 53/tcp

allow adds allow rules, and deny adds deny rules. Port rules without a specified protocol can apply to both TCP and UDP, so it is clearer to specify the required protocol. Rule order is important, and the first matching rule may be applied, so adding a deny rule when allow rules already exist does not necessarily block access.

Allow access only from specific IPs

The following is an example of allowing connections only to TCP port 22 from a single IPv4 address. 192.0.2.10 is a placeholder address for explanation purposes, so replace it with the actual admin access IP, and if the IP can be changed, prepare a recovery method first.

sudo ufw allow from 192.0.2.10 to any port 22 proto tcp

Even if you add this rule, access may not be restricted if a rule allowing port 22 from all addresses remains. Check the existing rules and their order using the numbered list, and keep only the rules that are actually necessary. If the server has IPv6 enabled, do not assume that an IPv4-only rule restricts IPv6 access; also check the IPv6 policies and rules.

sudo ufw status numbered

Deleting rules and disabling the firewall

To delete a rule you added with the exact content, use delete in the original command. For example, the command below deletes a rule allowing UDP port 53, while TCP rules are separate.

sudo ufw delete allow 53/udp

You can also delete by number, but if you delete one rule, the numbers change. Always check the current number and content again with sudo ufw status numbered. Number-based deletion only deletes one displayed IPv4 or IPv6 rule, so check the corresponding rule for the other IP version as well. After deletion, check the status again and test the actual connection.

To turn off the firewall, use the following command. When disabled, the protection provided by UFW is removed, so do not assume it is safe just because another firewall exists; first, check the scope of impact.

sudo ufw disable

When a rule does not behave as expected

Check whether the service is running, whether the correct port and protocol are allowed, the order of the rules, and the default policies. Also, review the rules of the cloud firewall, router, and upstream network, as well as the IPv4 or IPv6 addresses used to connect. Because of containers or separately managed network rules, it may be difficult to judge overall behavior using only the UFW status list.

Before actually changing a rule, you can preview the changes using --dry-run. For example, the following command shows the changes to a TCP 80 allow rule without applying them.

sudo ufw --dry-run allow 80/tcp

The UFW status screen primarily shows rules managed by UFW commands and does not represent all firewall settings on the system. For additional explanations and command formats, refer to Ubuntu Server Firewall Documentation.