Open and Close Ports with UFW on Ubuntu

A firewall decides which network ports can be reached from the internet. Ubuntu includes UFW (Uncomplicated Firewall). A good rule is simple: close everything, then open only what you use, such as SSH, web traffic and nothing else.

Before you start, connect to your VPS with SSH. Keep that window open while you work, so a typing mistake cannot lock you out.

1. Allow SSH first

Turning on a firewall without allowing SSH cuts off your own connection. Do this first:

sudo ufw allow OpenSSH

If you changed the SSH port, allow that port instead, for example sudo ufw allow 2222/tcp.

2. Allow the services you run

For a normal website:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

You can also allow by name when a profile exists, such as sudo ufw allow 'Nginx Full'.

3. Turn the firewall on

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable
sudo ufw status verbose

The status list shows every rule. Open a second SSH window to confirm you can still log in.

4. Open a port only for your own IP

A database or admin panel should never be open to everyone. Allow only your address (replace 203.0.113.10 with yours):

sudo ufw allow from 203.0.113.10 to any port 5432 proto tcp

5. Remove a rule

sudo ufw status numbered
sudo ufw delete 3

The number is the one shown in the numbered list.

If you get locked out

Use the console in your AtoZNode account: open your server, then the console, log in and run sudo ufw disable. Fix the rules, then run sudo ufw enable again.

Good to know

UFW rules apply to the server itself. Docker publishes ports in its own way and can bypass UFW for containers. Bind private services to 127.0.0.1 instead of relying on UFW alone.
Pair the firewall with SSH keys and fail2ban. See secure a new Ubuntu VPS.

Run it on your own VPS

Ubuntu VPS in India: A fresh Ubuntu server with full root access. Prices are in rupees, you can pay by UPI, and you get a GST invoice.