Skip to content
Noiz Knowledgebase

How to Set Up a Firewall with UFW on Ubuntu and Debian

This guide shows you how to set up a basic firewall on Ubuntu or Debian using ufw (Uncomplicated Firewall), the friendly front-end to the system’s built-in packet filter. A firewall that only lets in what your server actually needs is one of the highest-value hardening steps you can take.

Last reviewed: 1 August 2026, against the current UFW on Ubuntu and Debian. It complements the official Ubuntu documentation; the lockout recovery notes are Noiz-specific.

The golden rule: allow SSH before you enable

Section titled “The golden rule: allow SSH before you enable”

The single most common way to lock yourself out of a VPS is enabling the firewall before allowing SSH through it. Always add the SSH rule first, confirm it, then enable the firewall.

1. Check the starting state

Section titled “1. Check the starting state”
Terminal window
sudo ufw status verbose

On a fresh server this is usually Status: inactive. If it is already active with rules you did not add, stop and find out why before changing anything.

2. Allow SSH

Section titled “2. Allow SSH”
Terminal window
sudo ufw allow OpenSSH

This opens the standard SSH port (22). If you run SSH on a non-standard port, allow that port explicitly instead, for example sudo ufw allow 2222/tcp. Verify the rule landed:

Terminal window
sudo ufw show added

3. Allow your services

Section titled “3. Allow your services”

Add a rule for whatever the server runs. Common ones:

Terminal window
sudo ufw allow 80/tcp     # HTTP
sudo ufw allow 443/tcp    # HTTPS
sudo ufw allow 25/tcp     # SMTP, for a mail server

UFW also knows many services by name (sudo ufw allow 'Nginx Full', sudo ufw allow 'Apache Full'); list them with sudo ufw app list.

4. Enable the firewall

Section titled “4. Enable the firewall”
Terminal window
sudo ufw enable
sudo ufw status verbose

UFW warns that enabling may disrupt existing SSH connections; because you allowed OpenSSH in step 2, answer y. The default policy is to deny incoming and allow outgoing, which is what a server wants. Confirm OpenSSH (or your custom port) shows ALLOW in the status output.

Managing rules

Section titled “Managing rules”
  • List with numbers: sudo ufw status numbered
  • Delete a rule: sudo ufw delete 3 (the number from the list above), or sudo ufw delete allow 80/tcp
  • Allow from one IP only: sudo ufw allow from 203.0.113.10 to any port 22 (restrict SSH to your own address if you have a static one)
  • Disable temporarily: sudo ufw disable
  • Reset everything: sudo ufw reset (careful — this deletes all rules)

If you lock yourself out

Section titled “If you lock yourself out”

If you enabled the firewall without allowing SSH, you cannot connect — but the server is fine. Open the VNC console from your VPS panel (SolusVM or Virtualizor), log in, and either allow SSH (sudo ufw allow OpenSSH) or disable the firewall (sudo ufw disable) while you fix the rules. The console works independently of the network, so a firewall mistake is always recoverable this way.

What next

Section titled “What next”

A firewall is one layer. Combine it with key-based SSH login (How to Set Up SSH Key-Based Authentication) and the rest of the initial server setup for a solid baseline. For brute-force protection on top of the firewall, look at fail2ban; if your server’s own fail2ban ever blocks your IP, Noiz has a guide for recovering from exactly that.