Ubuntu UFW Firewall: Plan Rules Before Enabling It

UFW provides a convenient way to manage a host firewall on Ubuntu. The dangerous moment is often the first enable command on a remote server: if the active SSH path is not allowed, you can lock yourself out before you have tested the policy.

Inventory the services first

List the ports the machine is meant to accept and identify who needs to reach each one. A public web server, a private database and a maintenance endpoint should not automatically receive identical rules. Check cloud firewalls and provider controls too; host rules are only one layer.

Review the current state before editing:

sudo ufw status verbose
sudo ufw app list

The application profiles installed on the server can show named services, but confirm the ports and source networks they cover. Ubuntu's firewall guide documents UFW syntax and source-restricted rules.

Protect the management path

If SSH uses its default port, confirm that an SSH profile or explicit TCP rule matches the actual listener. If SSH listens on a different port, allow that exact port and source range. Do not assume opening port 22 helps a service configured on 2222.

Use a provider console or another verified recovery path before changing remote firewall policy. Consider a staged change with an explicit rollback plan. The exact safe order depends on the existing default policies, IPv4 and IPv6 settings, and provider network rules.

Apply the smallest useful policy

Allow only required services, and restrict administration to a trusted address range where practical. Review numbered rules and remove obsolete entries carefully. After each change, test a new connection from the expected client and verify that the application still works over both address families you use.

UFW is a host firewall interface, not a substitute for service authentication, patching or network design. Keep a record of why each exception exists so that temporary access does not become permanent by accident.