UFW in Linux: A Firewall You Will Keep

UFW — the Uncomplicated Firewall — puts sane default-deny on any Linux box in about four commands. It is a friendly front end to iptables/nftables, and its value is not power but the firewall you will actually keep enabled.

The shape of a policy #

Every firewall is two decisions: what is denied by default, and what exceptions you open. UFW's recommended order:

$ sudo ufw default deny incoming
$ sudo ufw default allow outgoing
$ sudo ufw allow OpenSSH            # before enabling, always
$ sudo ufw enable
$ sudo ufw status verbose

The allow-SSH-first rule is the classic remote-administrator mistake avoided: enabling a default-deny firewall without allowing your own session locks you out of the machine. Every guide repeats it because everyone knows someone it happened to.

Rules by name, port, and address #

$ sudo ufw allow 443/tcp                 # one port, TCP only
$ sudo ufw allow http                    # by service name (80)
$ sudo ufw allow from 10.0.0.0/24        # a trusted subnet, any port
$ sudo ufw allow from 10.0.0.5 to any port 5432   # one host, one port

The last form is the professional habit: administrative ports (databases, dashboards) restricted to specific source addresses rather than the whole internet. Pair it with ss — every listening port either has a reason and a rule, or gets bound to localhost.

limit is quietly excellent for SSH: it allows connections but throttles repeated attempts from one source — a speed bump against credential stuffing, layered under key-only hardening.

The method behind the rules #

A firewall policy is a list, and the list deserves the same care as code:

1. Inventory: ss -tlnp — every listening port is a rule or a fix.
2. Default deny incoming, allow outgoing — the standard posture for servers and laptops alike.
3. Open minimally: service ports to everyone; admin ports to known addresses.
4. Test from outside — nc -zv host port (netcat) from another machine proves the rule works and the denials deny.
5. Persist the policy — UFW rules survive reboots by design; document them in the machine's setup notes.

ufw reset wipes every rule to factory defaults — recovery is re-entering the policy, which is why the rule list belongs in version control with the rest of the setup. And on Docker hosts, know that Docker programs its own iptables paths that bypass UFW — published container ports are open regardless; see the containers series.

For the fuller policy picture, see firewalls on Linux; for what lives behind the rules, nginx. The network series continues.