Basic firewall setup takes three commands. Real servers need more: an admin panel only your office can reach, a database only the app server may use, a game server port range, and logging that doesn’t flood the disk. This guide collects UFW recipes for those situations. (For raw nftables, see Linux firewall rules via the CLI.)

Baseline

ufw default deny incoming
ufw default allow outgoing
ufw allow OpenSSH
ufw enable
ufw status numbered

Allow a service only from specific IPs

# Admin panel on 8443 from the office only
ufw allow from 203.0.113.50 to any port 8443 proto tcp

# A whole subnet
ufw allow from 198.51.100.0/24 to any port 22 proto tcp

Then remove any broader rule for the same port (ufw status numbered, ufw delete <n>).

Database for one app server

ufw allow from 10.10.0.1 to any port 3306 proto tcp   # via a private tunnel

Better still, have the database listen only on a private/tunnel address — see site-to-site VPN tunnel.

Rate-limit SSH

ufw limit OpenSSH

limit denies an IP that opens 6 or more connections within 30 seconds — enough to slow brute-force bots without affecting normal use.

Port ranges (games, VoIP, passive FTP)

ufw allow 27015:27030/udp
ufw allow 40000:40100/tcp

Web server with HTTP/3

ufw allow 80,443/tcp
ufw allow 443/udp          # QUIC / HTTP/3

Only allow web traffic from your CDN or WAF

If all traffic comes through Cloudflare or another proxy, block direct access to the origin. Allow each of the provider’s published IP ranges:

for net in $(curl -s https://www.cloudflare.com/ips-v4); do
  ufw allow from "$net" to any port 443 proto tcp
done
ufw delete allow 80,443/tcp      # remove the open rule

Refresh the list periodically — providers change ranges occasionally. See VPS + Cloudflare.

Rules per interface

# Allow everything on the private tunnel interface
ufw allow in on wg0
# Allow a port only on the public interface
ufw allow in on ens3 to any port 443 proto tcp

Block an abusive IP

ufw insert 1 deny from 192.0.2.66

insert 1 puts the rule first — UFW evaluates rules in order and stops at the first match, so a deny placed after an allow for the same traffic would never trigger.

Outgoing restrictions

Most servers allow all outgoing traffic. To restrict it (for example on a server that should never send mail directly):

ufw deny out 25/tcp

Note that on our Hong Kong and Japan VPS plans, outbound mail ports are already blocked at the network level; only USA VPS plans allow mail ports — see Email VPS.

Logging without flooding the disk

ufw logging low        # off | low | medium | high | full
journalctl -k | grep UFW | tail

low logs blocked packets that don’t match a rule, with rate limiting. Avoid high/full except for short debugging sessions.

Docker and UFW

Docker inserts its own iptables rules, so -p 8080:80 publishes a port even if UFW denies it. Options:

  1. Publish on localhost only: -p 127.0.0.1:8080:80, and use a reverse proxy.
  2. Use the DOCKER-USER chain for filtering, or a helper like ufw-docker.

See reverse proxy for Docker containers.

Test before you trust

From another machine:

nmap -Pn -p 22,80,443,3306,8443 YOUR_SERVER_IP

Only the ports you intend to expose should show as open.

Recover from a mistake

If a rule locks you out of SSH, log in through the VNC console in your control panel and run ufw disable or delete the bad rule. Related: protecting your VPS from port scans.

  • Firewall
  • UFW
  • Security