How to Set Up UFW Firewall on Linux VPS
to Block Unauthorized Access

One of the first things you should do after getting a Linux VPS is set up a firewall to control network traffic and protect against port scanning, brute force attacks, and unauthorized access. UFW (Uncomplicated Firewall) is the default firewall tool on Ubuntu and Debian — easy to use, powerful, and suitable for both beginners and experienced administrators.

1. What is UFW and Why Use It?

UFW stands for Uncomplicated Firewall. It is a frontend for iptables that simplifies firewall rule management. UFW ships with Ubuntu since version 8.04 and is fully supported on Debian.

Why configure a firewall on your VPS:

• Internet-connected VPS servers are port-scanned constantly — sometimes thousands of times per hour
• Services listening on unintended ports can be exploited by attackers
• A firewall immediately reduces your attack surface even if underlying services have vulnerabilities
• Restricts SSH access to specific trusted IP addresses

2. Installing UFW on Ubuntu/Debian

Ubuntu 20.04+ ships with UFW pre-installed but disabled. On Debian you may need to install it:

# Update package list
sudo apt update

# Install UFW (usually pre-installed on Ubuntu)
sudo apt install ufw -y

# Check version
ufw version

Verify UFW is installed but not yet active:

sudo ufw status
# Output: Status: inactive

3. Setting Default Policies

The key principle for a good firewall is Deny All, Allow Specific — block everything first, then open only what is necessary:

# Deny all incoming (except explicitly allowed)
sudo ufw default deny incoming

# Allow all outgoing (server can communicate outward normally)
sudo ufw default allow outgoing

4. Allowing and Denying Ports

Allow SSH (Critical — do this first)

# Allow port 22 (standard SSH)
sudo ufw allow 22/tcp

# Or use the service name
sudo ufw allow ssh

# If using a custom SSH port like 2222
sudo ufw allow 2222/tcp

Allow Web Server Ports

# HTTP
sudo ufw allow 80/tcp

# HTTPS
sudo ufw allow 443/tcp

# Or allow both HTTP and HTTPS via application profile
sudo ufw allow 'Nginx Full'
sudo ufw allow 'Apache Full'

Allow Port Ranges

# Allow ports 8000-8100 for TCP
sudo ufw allow 8000:8100/tcp

# FTP Passive Mode ports
sudo ufw allow 20000:21000/tcp

Deny Ports

# Deny MySQL (should not be exposed publicly)
sudo ufw deny 3306/tcp

# Remove an existing allow rule
sudo ufw delete allow 80/tcp

5. IP Whitelist and Blacklist

Allow a Specific IP

# Allow single IP on all ports
sudo ufw allow from 203.0.113.10

# Allow single IP only on port 22
sudo ufw allow from 203.0.113.10 to any port 22

# Allow entire /24 subnet on port 22
sudo ufw allow from 203.0.113.0/24 to any port 22

Block a Suspicious IP

# Block a single IP
sudo ufw deny from 198.51.100.45

# Block an entire subnet
sudo ufw deny from 198.51.100.0/24

6. Rate Limiting Against Brute Force

The UFW limit command automatically blocks any IP that connects more than 6 times within 30 seconds:

# Enable rate limiting for SSH
sudo ufw limit ssh

# Or specify the port number
sudo ufw limit 22/tcp

When this rule is active, UFW will:

• Count connection attempts from the same IP
• If an IP connects more than 6 times in 30 seconds → temporarily block it
• After the rate drops — the IP can connect again

7. Enabling UFW

After configuring all your rules, enable UFW:

# Enable UFW (will prompt for confirmation)
sudo ufw enable

# Output:
# Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
# Firewall is active and enabled on system startup

Disable UFW Temporarily

sudo ufw disable

Reload UFW After Rule Changes

sudo ufw reload

8. Checking Status and Rules

# Basic status check
sudo ufw status

# Rules with numbers (useful for deletion)
sudo ufw status numbered

# Full detailed view
sudo ufw status verbose

Example output of ufw status numbered:

Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 2] 80/tcp                     ALLOW IN    Anywhere
[ 3] 443/tcp                    ALLOW IN    Anywhere
[ 4] 22/tcp (v6)                ALLOW IN    Anywhere (v6)
[ 5] 80/tcp (v6)                ALLOW IN    Anywhere (v6)
[ 6] 443/tcp (v6)               ALLOW IN    Anywhere (v6)

Delete a Rule by Number

# Delete rule number 3
sudo ufw delete 3

9. UFW Logging

Logging helps you identify blocked connection attempts:

# Enable low logging (blocked packets only)
sudo ufw logging low

# Medium logging (blocked + invalid packets)
sudo ufw logging medium

# Watch logs in real time
sudo tail -f /var/log/ufw.log

# View only blocked entries
sudo grep "BLOCK" /var/log/ufw.log | tail -20

10. Web Server Configuration Example

A practical UFW config for a VPS running Nginx + DirectAdmin:

# Start fresh
sudo ufw --force reset

# Default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# SSH with rate limiting (critical)
sudo ufw limit 22/tcp

# DirectAdmin panel
sudo ufw allow 2222/tcp

# HTTP / HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# FTP (only if needed)
sudo ufw allow 21/tcp
sudo ufw allow 20000:21000/tcp

# Enable logging
sudo ufw logging low

# Enable UFW
sudo ufw enable

# Verify
sudo ufw status numbered

11. UFW Command Quick Reference

12. Frequently Asked Questions