UFW in Linux: A Practical Guide to the Uncomplicated Firewall

Published by 1Corp | Linux Guides

If you use Linux and want a simple way to control network access, UFW is one of the easiest tools to start with. UFW stands for Uncomplicated Firewall, and that name fits. It gives you a cleaner and easier way to manage firewall rules without having to write raw iptables or nftables rules by hand.

On many Ubuntu-based systems, UFW is either already installed or available directly from the default repositories. It is especially useful for desktops, laptops, home servers, VPS systems, and small self-hosted services where you want solid protection without a steep learning curve.

In plain English: UFW helps you decide what network traffic gets in, what goes out, and which ports or services should be allowed or blocked.

Why UFW Matters

A firewall is one of the most basic security controls on a Linux system. If a service is listening on a port and your machine is connected to a network, that service may be reachable unless you restrict it. UFW makes it much easier to lock that down.

Typical reasons to use UFW include:

Blocking unsolicited inbound connections
Allowing only the services you actually need
Reducing the attack surface on desktops and servers
Controlling SSH, web, mail, and custom service access
Quickly checking active firewall rules in a readable format

Installing UFW

On Ubuntu, Linux Mint, Debian, and many related distributions, installing UFW is straightforward:

sudo apt update
sudo apt install ufw

After installation, you can verify it is available:

sudo ufw status verbose

Default Behavior

A common and sensible setup is to deny incoming connections by default while allowing outgoing traffic. That means your system can still browse the web, fetch updates, and connect outward, but outside systems cannot freely connect in unless you create a rule for it.

sudo ufw default deny incoming
sudo ufw default allow outgoing

Important: If you are managing a remote server over SSH, allow SSH before enabling the firewall, or you may lock yourself out.

Allowing SSH Before Enabling UFW

If you connect to your machine remotely with SSH, run this first:

sudo ufw allow OpenSSH

Or use the port number directly:

sudo ufw allow 22/tcp

Then enable the firewall:

sudo ufw enable

Checking Firewall Status

One of the best things about UFW is that it gives you easy-to-read status output.

sudo ufw status
sudo ufw status verbose
sudo ufw status numbered

The numbered output is especially useful because it lets you delete rules by number instead of rewriting them.

Common UFW Commands

Allow a Service

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

This is common for web servers. Port 80 is usually HTTP, and port 443 is HTTPS.

Allow a Named Profile

sudo ufw app list
sudo ufw allow OpenSSH

Some applications install firewall profiles, which makes things even easier.

Deny a Port

sudo ufw deny 23/tcp

Telnet is a good example of something you usually do not want exposed.

Delete a Rule

sudo ufw delete allow 80/tcp

Or by rule number:

sudo ufw status numbered
sudo ufw delete 2

Insert a Rule at a Specific Position

sudo ufw insert 1 allow 22/tcp

This can matter if you want a rule evaluated earlier in the list.

Allowing Access Only From a Specific IP

Sometimes you do not want to open a service to everyone. You may want to allow only your home IP, office IP, or VPN exit point.

sudo ufw allow from 192.168.1.50 to any port 22 proto tcp

That rule says: allow SSH only from that one IP address.

Blocking a Specific IP

sudo ufw deny from 203.0.113.25

This can be useful if you see repeated unwanted traffic from one source.

UFW for Desktop Users

Many Linux desktop users do not need to manually open any ports at all. In a normal home setup, denying incoming traffic and allowing outgoing traffic is often enough. That means you still get internet access, software updates, package downloads, email, and web browsing, but random inbound connection attempts are blocked.

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable

UFW for Servers

On a server, you usually want a tighter and more intentional rule set. For example:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

That gives you a simple web server setup with SSH management and HTTP/HTTPS access.

Logging

UFW can log blocked or allowed traffic, which helps when troubleshooting.

sudo ufw logging on
sudo ufw logging low

Log levels can be adjusted depending on how much detail you want.

Disabling UFW

If you need to temporarily turn the firewall off:

sudo ufw disable

That stops enforcement, but your saved rules remain available for when you enable it again.

Resetting UFW

If you made a mess of your rules and want to start over:

sudo ufw reset

Warning: This removes your current UFW rules. On a remote server, make sure you know exactly what you are doing before using it.

Troubleshooting Tips

Check active rules with sudo ufw status numbered
Make sure the service is actually listening on the expected port
Confirm whether the service uses TCP, UDP, or both
Remember that cloud firewalls or router firewalls may also affect access
Allow SSH before enabling UFW on any remote box

Example: Basic Home or Office Workstation Setup

sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable
sudo ufw status verbose

For a machine that is mainly used for web browsing, writing, coding, or office work, that is often enough.

Example: Basic Web Server Setup

sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status numbered

Final Thoughts

UFW is one of the best Linux tools for people who want firewall control without firewall complexity. It gives you readable commands, sensible defaults, and enough flexibility for both desktop and server use.

If you are running Linux and have never set up a firewall, UFW is a good place to start. It is simple, practical, and effective.

Need more Linux help?
Visit 1Corp Linux Guides for more Linux tutorials, troubleshooting articles, and practical how-to content.