How to Set Up a Firewall on Linux with UFW

An open port with no firewall rule is an open invitation for automated scanners and attackers. Setting up a UFW firewall on Linux is one of the simplest ways to control exactly which network traffic reaches your server, blocking everything by default except the specific ports and services you explicitly allow.

What Is UFW?

UFW (Uncomplicated Firewall) is a user-friendly front end for iptables, the powerful but notoriously complex Linux firewall system. Instead of writing intricate iptables rules by hand, UFW lets you manage firewall behavior with simple, readable commands, making it the default firewall tool on Ubuntu and widely available on other Debian-based distributions.

Why Use a Firewall at All?

Even with services properly secured (SSH hardening, Fail2Ban, disabled root login), an unmanaged firewall still allows connections to reach every open port on your server, relying entirely on each individual service to handle unwanted traffic correctly. A firewall adds a critical layer in front of everything, blocking connections before they ever reach a vulnerable or misconfigured service.

Installing UFW

On most Debian/Ubuntu systems, UFW is already installed. If not:

sudo apt update
sudo apt install ufw -y

Setting Default Policies

Before enabling UFW, establish sensible defaults — deny all incoming connections while allowing all outgoing ones:

sudo ufw default deny incoming
sudo ufw default allow outgoing

This “deny by default” approach means anything not explicitly allowed is automatically blocked.

Allowing Essential Services

Before enabling the firewall, make sure to allow SSH access, or you risk locking yourself out entirely:

sudo ufw allow ssh

Or, if you’ve changed SSH to a custom port as part of hardening:

sudo ufw allow 2222/tcp

Add rules for any other services you’re running, for example:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Enabling the Firewall

Once your essential rules are in place:

sudo ufw enable

Confirm the firewall is active and review current rules:

sudo ufw status verbose

Allowing Access from Specific IPs Only

For services you want restricted to your home network or a specific trusted IP rather than the entire internet:

sudo ufw allow from 192.168.1.0/24 to any port 8096

This allows access to port 8096 (a common Jellyfin port, for example) only from devices on your local subnet.

Removing or Adjusting Rules

List rules with numbers for easy reference:

sudo ufw status numbered

Delete a specific rule by its number:

sudo ufw delete 3

Logging Firewall Activity

Enable logging to monitor blocked connection attempts, useful for spotting patterns of scanning or attack attempts against your server:

sudo ufw logging on

Logs can then be reviewed in /var/log/ufw.log.

Combining UFW with Fail2Ban

UFW and Fail2Ban work well together rather than replacing each other — UFW controls which ports are reachable at all, while Fail2Ban actively bans IPs showing malicious behavior on the ports you’ve chosen to leave open, such as repeated failed SSH login attempts.

Final Thoughts

Setting up a UFW firewall on Linux takes just a few commands but fundamentally changes your server’s security posture from “everything reachable unless blocked” to “nothing reachable unless explicitly allowed.” Combined with SSH hardening and Fail2Ban, a properly configured firewall forms one of the core layers of any well-secured Linux server or homelab.