ufwManage the host firewall the simple way
ufw (Uncomplicated Firewall) is Ubuntu's front end to the kernel's netfilter firewall. With one-line rules like 'allow 443/tcp' or 'allow from 10.0.0.0/16 to any port 5432' you set a default-deny policy for incoming traffic and open only what the server needs.
ufw [--dry-run] enable|disable|status [verbose|numbered] | default allow|deny incoming|outgoing | [insert N] allow|deny|limit|reject RULE | delete RULE|NA fresh Ubuntu server will run nginx. You want only SSH, HTTP and HTTPS reachable from the internet.
sudoFirewall rules change kernel state; ufw refuses to run without root.
ufw is a Python program that manages netfilter, the packet filter inside the kernel. On Ubuntu 24.04 it drives iptables-nft, so the rules end up as nftables rules. Your rules are stored in /etc/ufw/user.rules and user6.rules (IPv6 gets a copy of each rule unless you give an IPv4 address), defaults in /etc/default/ufw, and fixed rules that run before yours (loopback, established connections, ICMP, DHCP) in /etc/ufw/before.rules. 'ufw enable' loads everything into the kernel and enables ufw.service so it's reapplied at boot. Every incoming packet walks the chains: before rules first, then your rules in order, and the first match wins; if nothing matches, the default policy (deny incoming) applies. The connection tracking rule in before.rules accepts replies to connections the host started, which is why 'default allow outgoing' works without opening return ports. 'limit' uses the recent module to reject an IP that opens 6 or more connections within 30 seconds.
status [verbose|numbered]Show rules; verbose adds defaults and logging, numbered adds rule numbersenable / disableLoad rules and start at boot / flush and stopdefault deny incomingPolicy for traffic no rule matchesallow PORT[/PROTO]Open a port: allow 443/tcp, allow 51820/udpallow from CIDR to any port NOpen a port only for a source networklimit sshAllow, but reject sources opening 6+ connections in 30 sdeny / reject from IPBlock a source silently / with an ICMP or TCP resetinsert N RULEPut a rule at position N (order matters: first match wins)delete N / delete RULERemove by number (from status numbered) or by repeating the ruleapp list / allow 'Nginx Full'Use application profiles from /etc/ufw/applications.d--dry-runPrint the resulting rules without applying themshow addedYour rules as the commands that created themsudo ufw enable on a remote server before allowing SSHDefault deny incoming applies immediately, and new SSH connections (sometimes even yours) are dropped: you're locked out.
sudo ufw allow OpenSSH (or limit ssh) first, then enable; keep a second session open while testingAppending a deny rule after existing allow rulesRules are evaluated in order and the first match wins, so the earlier allow still accepts the traffic.
sudo ufw insert 1 deny from IP (delete any existing copy first)ufw allow 5432 to open PostgreSQLOpens TCP and UDP from the entire internet.
sudo ufw allow from 10.0.0.0/16 to any port 5432 proto tcpTrusting ufw to protect ports published by DockerDocker's own iptables rules handle forwarded traffic before ufw sees it, so -p 8080:80 is exposed regardless of ufw.
Bind published ports to 127.0.0.1, use the DOCKER-USER chain, or a cloud security groupTry these on a Linux machine of your own. Each task has a hint and a solution.
Show the firewall status with rule numbers and the default policies.
Preview, without applying, what allowing 8080/tcp would change.
Allow SSH (rate-limited) and HTTPS, deny everything else incoming, enable the firewall, then remove the HTTPS rule by number.
ufwManage the host firewall the simple way
ufw (Uncomplicated Firewall) is Ubuntu's front end to the kernel's netfilter firewall. With one-line rules like 'allow 443/tcp' or 'allow from 10.0.0.0/16 to any port 5432' you set a default-deny policy for incoming traffic and open only what the server needs.
ufw [--dry-run] enable|disable|status [verbose|numbered] | default allow|deny incoming|outgoing | [insert N] allow|deny|limit|reject RULE | delete RULE|NA fresh Ubuntu server will run nginx. You want only SSH, HTTP and HTTPS reachable from the internet.
sudoFirewall rules change kernel state; ufw refuses to run without root.
ufw is a Python program that manages netfilter, the packet filter inside the kernel. On Ubuntu 24.04 it drives iptables-nft, so the rules end up as nftables rules. Your rules are stored in /etc/ufw/user.rules and user6.rules (IPv6 gets a copy of each rule unless you give an IPv4 address), defaults in /etc/default/ufw, and fixed rules that run before yours (loopback, established connections, ICMP, DHCP) in /etc/ufw/before.rules. 'ufw enable' loads everything into the kernel and enables ufw.service so it's reapplied at boot. Every incoming packet walks the chains: before rules first, then your rules in order, and the first match wins; if nothing matches, the default policy (deny incoming) applies. The connection tracking rule in before.rules accepts replies to connections the host started, which is why 'default allow outgoing' works without opening return ports. 'limit' uses the recent module to reject an IP that opens 6 or more connections within 30 seconds.
status [verbose|numbered]Show rules; verbose adds defaults and logging, numbered adds rule numbersenable / disableLoad rules and start at boot / flush and stopdefault deny incomingPolicy for traffic no rule matchesallow PORT[/PROTO]Open a port: allow 443/tcp, allow 51820/udpallow from CIDR to any port NOpen a port only for a source networklimit sshAllow, but reject sources opening 6+ connections in 30 sdeny / reject from IPBlock a source silently / with an ICMP or TCP resetinsert N RULEPut a rule at position N (order matters: first match wins)delete N / delete RULERemove by number (from status numbered) or by repeating the ruleapp list / allow 'Nginx Full'Use application profiles from /etc/ufw/applications.d--dry-runPrint the resulting rules without applying themshow addedYour rules as the commands that created themsudo ufw enable on a remote server before allowing SSHDefault deny incoming applies immediately, and new SSH connections (sometimes even yours) are dropped: you're locked out.
sudo ufw allow OpenSSH (or limit ssh) first, then enable; keep a second session open while testingAppending a deny rule after existing allow rulesRules are evaluated in order and the first match wins, so the earlier allow still accepts the traffic.
sudo ufw insert 1 deny from IP (delete any existing copy first)ufw allow 5432 to open PostgreSQLOpens TCP and UDP from the entire internet.
sudo ufw allow from 10.0.0.0/16 to any port 5432 proto tcpTrusting ufw to protect ports published by DockerDocker's own iptables rules handle forwarded traffic before ufw sees it, so -p 8080:80 is exposed regardless of ufw.
Bind published ports to 127.0.0.1, use the DOCKER-USER chain, or a cloud security groupTry these on a Linux machine of your own. Each task has a hint and a solution.
Show the firewall status with rule numbers and the default policies.
Preview, without applying, what allowing 8080/tcp would change.
Allow SSH (rate-limited) and HTTPS, deny everything else incoming, enable the firewall, then remove the HTTPS rule by number.