---
title: "How to Set Up a Firewall with UFW on Ubuntu and Debian"
description: "How to configure the UFW firewall on Ubuntu or Debian: allow SSH and your services, enable the firewall, check its status, and avoid locking yourself out."
url: "https://docs.noiz.ie/linux/how-to-set-up-a-firewall-with-ufw-on-ubuntu-and-debian/"
section: "How to Linux"
categories:
  - "Server Administration > Linux Basics > Security"
tags:
  - "firewall"
  - "ufw"
  - "linux"
  - "security"
  - "vps"
last_reviewed: "1 August 2026, against the current UFW on Ubuntu and Debian"
---

# How to Set Up a Firewall with UFW on Ubuntu and Debian

This guide shows you how to set up a basic firewall on Ubuntu or Debian using **ufw** (Uncomplicated Firewall), the friendly front-end to the system's built-in packet filter. A firewall that only lets in what your server actually needs is one of the highest-value hardening steps you can take.

**Last reviewed:** 1 August 2026, against the current UFW on Ubuntu and Debian. It complements the official Ubuntu documentation; the lockout recovery notes are Noiz-specific.

## The golden rule: allow SSH before you enable

The single most common way to lock yourself out of a VPS is enabling the firewall before allowing SSH through it. Always add the SSH rule **first**, confirm it, then enable the firewall.

## 1. Check the starting state

```bash
sudo ufw status verbose
```

On a fresh server this is usually `Status: inactive`. If it is already active with rules you did not add, stop and find out why before changing anything.

## 2. Allow SSH

```bash
sudo ufw allow OpenSSH
```

This opens the standard SSH port (22). If you run SSH on a non-standard port, allow that port explicitly instead, for example `sudo ufw allow 2222/tcp`. Verify the rule landed:

```bash
sudo ufw show added
```

## 3. Allow your services

Add a rule for whatever the server runs. Common ones:

```bash
sudo ufw allow 80/tcp     # HTTP
sudo ufw allow 443/tcp    # HTTPS
sudo ufw allow 25/tcp     # SMTP, for a mail server
```

UFW also knows many services by name (`sudo ufw allow 'Nginx Full'`, `sudo ufw allow 'Apache Full'`); list them with `sudo ufw app list`.

## 4. Enable the firewall

```bash
sudo ufw enable
sudo ufw status verbose
```

UFW warns that enabling may disrupt existing SSH connections; because you allowed OpenSSH in step 2, answer `y`. The default policy is to deny incoming and allow outgoing, which is what a server wants. Confirm `OpenSSH` (or your custom port) shows `ALLOW` in the status output.

## Managing rules

- **List with numbers:** `sudo ufw status numbered`
- **Delete a rule:** `sudo ufw delete 3` (the number from the list above), or `sudo ufw delete allow 80/tcp`
- **Allow from one IP only:** `sudo ufw allow from 203.0.113.10 to any port 22` (restrict SSH to your own address if you have a static one)
- **Disable temporarily:** `sudo ufw disable`
- **Reset everything:** `sudo ufw reset` (careful: this deletes all rules)

## If you lock yourself out

If you enabled the firewall without allowing SSH, you cannot connect, but the server is fine. Open the VNC console from your VPS panel ([SolusVM](/solusvm/how-to-access-your-vps-via-the-vnc-console-in-solusvm/) or [Virtualizor](/virtualizor/how-to-access-your-vps-via-the-vnc-console-in-virtualizor/)), log in, and either allow SSH (`sudo ufw allow OpenSSH`) or disable the firewall (`sudo ufw disable`) while you fix the rules. The console works independently of the network, so a firewall mistake is always recoverable this way.

## What next

A firewall is one layer. Combine it with key-based SSH login ([How to Set Up SSH Key-Based Authentication](/linux/how-to-set-up-ssh-key-based-authentication-on-a-linux-server/)) and the rest of the [initial server setup](/linux/initial-server-setup-with-ubuntu-on-a-noiz-vps/) for a solid baseline. For brute-force protection on top of the firewall, look at fail2ban; if your server's own fail2ban ever blocks your IP, Noiz has a guide for recovering from exactly that.

---
Source: https://docs.noiz.ie/linux/how-to-set-up-a-firewall-with-ufw-on-ubuntu-and-debian/