UFW (Uncomplicated Firewall) is Ubuntu’s simpler command-line front end for configuring host firewall rules. A safe first setup is to check its status, set a default policy that denies unsolicited incoming traffic while allowing outgoing traffic, permit SSH, enable UFW, and then add only the service rules your machine needs.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This guide covers the commands for inspecting, creating, restricting, removing, logging, and resetting rules on Ubuntu and similar Linux systems. Test the SSH rule before enabling UFW if you are connected remotely.
As an Amazon Associate I earn from qualifying purchases.
What UFW does—and what it does not
UFW provides a friendlier interface to the underlying iptables firewall system. It is designed to make common IPv4 and IPv6 host-firewall tasks understandable without requiring you to write raw iptables rules. Ubuntu has included UFW by default in every installation since Ubuntu 8.04 LTS, although the service ships disabled until you turn it on.
Think of UFW as a rule manager for straightforward host filtering: allow a port, deny a port, limit repeated connection attempts, restrict access to a source address, and inspect or remove those rules. Canonical’s Ubuntu Server documentation cautions that the command interface is not intended to expose every possible firewall function. Complex packet-processing designs, unusual routing topologies, and advanced policy requirements may need direct netfilter/iptables or another firewall management layer.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
UFW rules can be stored while the firewall is inactive. A status of inactive therefore means the rules are not currently being enforced; it does not necessarily mean that no rules have been configured.
Check status before changing anything
Basic status
Run:
sudo ufw statusThe result reports whether UFW is active and, when active, displays the rules it is enforcing.
Verbose status and numbered rules
Use verbose output when you need the default policies and logging state:
sudo ufw status verboseWhen deleting a rule, list rules with stable-looking numbers first:
sudo ufw status numberedThe numbered view is the safest way to identify the exact entry to remove. Rule numbers can change after deletions, so run the command again before removing another entry.
Set a sensible default policy
Deny unsolicited incoming traffic
A common server and desktop baseline is:
sudo ufw default deny incomingNew inbound connections are refused according to the firewall’s default handling unless a more specific allow rule matches. Existing connections and applications that initiate outbound traffic are a separate consideration; do not assume this policy blocks programs from reaching the internet.
Recommended Free Tools
Allow outgoing traffic
Pair the inbound policy with:
sudo ufw default allow outgoingThis permits outbound connections by default, which is convenient for package updates, web access, game clients, and other software that connects to remote services. If your security model requires outbound filtering, you can create explicit egress rules instead, but that is a more involved policy than this baseline.
Allow SSH before enabling UFW
If you administer the machine over SSH, create an SSH allow rule before turning the firewall on:
sudo ufw allow sshOn systems with an installed application profile, the equivalent profile-based command is:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
sudo ufw allow OpenSSHThese commands normally permit the SSH service’s standard TCP port. If your SSH daemon listens on a different port, allow that port explicitly, for example:
sudo ufw allow 2222/tcpReplace 2222 with the port configured on your host. Confirm that the rule appears in sudo ufw status while your current SSH session is still working.
Enabling UFW on a remote host without an appropriate SSH rule can immediately cut off your session and prevent a new login. Keep an out-of-band console, hypervisor console, or hosting recovery method available when changing firewall policy remotely.
Enable, disable, and verify the firewall
Enable enforcement
Once the required management and service rules are present, enable UFW:
sudo ufw enableUFW will begin enforcing the stored policy. Verify the result and defaults:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutesudo ufw status verboseTemporarily disable enforcement
To turn enforcement off without deleting the configured rules, run:
sudo ufw disableDisabling is useful for controlled troubleshooting, but it leaves the host without UFW filtering. Re-enable it after testing and investigate the rule or application that caused the problem rather than leaving the firewall off.
Common allow rules
Allow a TCP or UDP port
Specify the protocol when the service requires it:
sudo ufw allow 22/tcp
sudo ufw allow 53/udpTCP and UDP are independent. Allowing TCP does not automatically allow UDP on the same port, and vice versa. Use the protocol required by the application’s documentation.
Allow a service by name
For common services, UFW can use a service name instead of a numeric port:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
sudo ufw allow http
sudo ufw allow httpsService names are resolved through UFW’s application and service definitions on the installed system. If a name is not recognized, use an explicit port and protocol or inspect available profiles.
Allow a port range
When an application genuinely needs a contiguous range, UFW supports a range expression with a protocol, such as:
sudo ufw allow 30000:30010/tcpUse the narrowest range possible. Opening a large range is easier than identifying the application’s exact requirements, but it increases the number of reachable services and therefore the attack surface.
Restrict rules by source address
Permit an entire subnet
To allow hosts in a private network to reach the machine, specify the subnet:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo ufw allow from 192.168.10.0/24This permits traffic from addresses in that subnet according to the generated rule. It is broader than allowing one administrative workstation, so use the smallest network that fits your environment.
Permit one host to SSH
To limit SSH access to one source address:
sudo ufw allow from 192.168.1.7 port sshThis is often safer than exposing SSH to every source on the internet. Make sure the source address is stable; a changing home or mobile address can lock out legitimate administration when it changes.
Block one address from SSH
A deny rule can target a specific source and service. For example:
sudo ufw deny from 203.0.113.45 to any port 22Replace the example address with the address you intend to block. A source-specific rule avoids denying SSH to every other client.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDeny, reject, and rate-limit traffic
Deny a port
To block a service port explicitly:
sudo ufw deny 3306/tcpA deny rule is useful when a service should remain inaccessible even if a broader policy or another rule would otherwise permit it. Review the complete rule set to ensure that a more specific or earlier rule is not producing an unexpected result.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Reject instead of silently dropping
Use reject when you want the sender to receive an explicit refusal:
sudo ufw reject 3306/tcpDropping traffic can make scans and failed connections time out; rejecting generally fails faster and can be easier for legitimate clients to diagnose. The choice is a policy decision, not a guarantee of invisibility.
Rate-limit SSH
UFW’s limit action is intended to slow repeated connection attempts:
sudo ufw limit 22/tcpThis can reduce the impact of basic SSH brute-force attempts by throttling repeated connections from the same source. It is not a replacement for strong authentication, key-based login, account hardening, updates, or intrusion monitoring.
Use application profiles
Installed applications can provide named profiles that bundle the ports and protocols they need. List the profiles available on the target system:
sudo ufw app listIf OpenSSH appears, allow it with:
sudo ufw allow OpenSSHProfile contents are local to the machine and can vary with installed packages. Inspect the profile details before relying on a name for a production rule. If no suitable profile exists, specify the required port and protocol directly.
Turn logging on and choose a level
Enable logging
Start UFW logging with:
sudo ufw logging onLogging can help correlate blocked connection attempts with an application’s symptoms and identify unexpected probes. On a busy internet-facing host, logs can grow quickly, so configure the operating system’s normal log rotation and retention policies.
Free tools Windows power users keep installed
One-click scans. No signup required.
Set a logging level
UFW accepts a logging level argument:
sudo ufw logging LEVELReplace LEVEL with a level supported by the UFW version installed on the machine. Because available levels and their exact behavior can vary, check the local manual with man ufw before selecting one for long-term operations.
Delete, reload, and reset rules
Delete by rule number
First display numbered rules:
sudo ufw status numberedThen delete the unwanted entry by its current number:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
sudo ufw delete NUMBERFor example, if the unwanted entry is numbered 3:
sudo ufw delete 3Confirm the remaining list after each deletion. Numbers are reassigned when the list changes.
Delete by repeating the original rule
You can also prefix the original rule with delete:
sudo ufw delete allow 53/udp
sudo ufw delete allow from 192.168.1.7 port sshThis method is convenient when you know the exact rule syntax used to create the entry. If the command does not match, use the numbered listing to identify the stored rule.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Reload the active rules
Apply the current configuration again with:
sudo ufw reloadReloading is useful after editing rule definitions or when you need to reapply the policy without disabling UFW.
Reset everything
To clear all UFW rules and return to an unconfigured state:
sudo ufw resetTreat reset as destructive. Record the existing policy first with sudo ufw status numbered, and be prepared to recreate your SSH and service rules before enabling the firewall again.
A safe first-time setup sequence
For a new Ubuntu host, this sequence establishes the common baseline while protecting remote administration:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo ufw default deny incomingsudo ufw default allow outgoingsudo ufw allow OpenSSH(orsudo ufw allow sshwhen that profile is not available)- Add each required application rule, specifying its port, protocol, and source where possible.
sudo ufw enablesudo ufw status verbose
Do not blindly copy this sequence to a host that needs other management paths, such as a web console, database replication, monitoring collector, or private game-server network. Add and verify those paths before step 5.
Troubleshoot the most common failures
“ufw enable” locked me out
The usual cause is enabling UFW before allowing SSH. Use a provider console or local terminal to run sudo ufw allow ssh (or the correct custom SSH port), then check sudo ufw status. If you cannot reach any console, use the host’s documented recovery process; an SSH client cannot repair a firewall that is blocking its own connection.
The rule exists but the service is unreachable
- Confirm enforcement with
sudo ufw status verbose; an inactive firewall does not enforce rules. - Verify the application is listening on the expected address and port.
- Check whether you allowed the correct protocol. TCP and UDP permissions are separate.
- Check source restrictions: a subnet or single-host rule may exclude the client you are testing.
- Inspect application and system logs, then enable UFW logging if you need packet-level evidence.
- Look for another firewall, cloud security group, router ACL, or container network policy outside UFW.
A command or profile is rejected
UFW syntax and available application profiles depend on the installed version and packages. Run man ufw on the target system for authoritative syntax, and use sudo ufw app list to see profiles that actually exist there. Prefer explicit port/protocol rules when a named profile is unavailable.
Commands at a glance
| Purpose | Command | Important qualification |
|---|---|---|
| Check state | sudo ufw status |
Shows whether enforcement is active. |
| Show defaults and logging | sudo ufw status verbose |
Includes policy details. |
| Number rules | sudo ufw status numbered |
Use before deleting by number. |
| Set inbound baseline | sudo ufw default deny incoming |
Blocks new inbound traffic unless allowed. |
| Set outbound baseline | sudo ufw default allow outgoing |
Allows outbound traffic by default. |
| Allow service | sudo ufw allow 22/tcp |
Protocol must match the service. |
| Allow by profile | sudo ufw allow OpenSSH |
Requires that profile to be installed. |
| Restrict source | sudo ufw allow from 192.168.1.7 port ssh |
Only the specified source is permitted. |
| Rate-limit | sudo ufw limit 22/tcp |
Slows repeated SSH connections; not full intrusion prevention. |
| Delete | sudo ufw delete NUMBER |
Number refers to the current numbered listing. |
| Reload | sudo ufw reload |
Reapplies the current configuration. |
| Clear rules | sudo ufw reset |
Destructive; recreate required access afterward. |
Use the local manual as the final authority
UFW’s command interface is intentionally simple, but distributions and installed versions can differ in supported options, profile names, and logging levels. Before using a less-common flag in a production script, run man ufw on the exact machine you are configuring. Keep a documented copy of the intended rules, especially the SSH rule, so a reset or recovery event does not leave you guessing which access paths must be restored.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
