🛡️
ufw cheat sheet
ufw (Uncomplicated Firewall) is a friendly front end to iptables/nftables on Ubuntu and Debian. Always allow SSH before enabling the firewall, or you can lock yourself out of a remote server.
Click any command to copy it.
Turn on safely
| Command | What it does |
|---|---|
sudo ufw default deny incoming | Block all incoming connections unless allowed. |
sudo ufw default allow outgoing | Allow all outgoing connections. |
sudo ufw allow 22/tcp | Allow SSH. Do this first. |
sudo ufw enable | Turn the firewall on (and at boot). |
sudo ufw status verbose | Show status, defaults and rules. |
sudo ufw status numbered | Show rules with numbers for deleting. |
Allow and deny
| Command | What it does |
|---|---|
sudo ufw allow 80,443/tcp | Allow HTTP and HTTPS. |
sudo ufw allow 6000:6007/tcp | Allow a port range. |
sudo ufw allow from 203.0.113.4 | Allow all traffic from one IP. |
sudo ufw allow from 203.0.113.4 to any port 22 | Allow one IP to reach SSH only. |
sudo ufw allow from 10.0.0.0/24 to any port 5432 | Allow a subnet to reach PostgreSQL. |
sudo ufw deny 23 | Block Telnet. |
sudo ufw limit ssh | Rate-limit SSH to slow down brute-force attempts. |
sudo ufw allow "Nginx Full" | Allow HTTP and HTTPS using an application profile. |
sudo ufw app list | List available application profiles. |
Delete and reset
| Command | What it does |
|---|---|
sudo ufw delete allow 80/tcp | Remove a rule by its definition. |
sudo ufw delete 2 | Remove a rule by its number from status numbered. |
sudo ufw disable | Turn the firewall off. |
sudo ufw reload | Reload the rules. |
sudo ufw reset | Destructive: Disable ufw and delete all rules. |
Logging
| Command | What it does |
|---|---|
sudo ufw logging on | Enable logging. |
sudo ufw logging medium | Set the log level. |
sudo tail -f /var/log/ufw.log | Watch blocked and allowed connections live. |
Frequently asked questions
How do I avoid locking myself out over SSH?
Run ufw allow 22/tcp (or your SSH port) before ufw enable, and keep a second session open while testing.
Does Docker bypass ufw?
Yes: published container ports are added to iptables directly and can bypass ufw rules. Bind ports to 127.0.0.1 or manage the DOCKER-USER chain.