How to Configure UFW on Ubuntu to Protect a VPS

Contents

• What to check first
• Step 1. Check whether UFW is installed
• Step 2. Allow SSH before enabling the firewall
• Step 3. Allow HTTP and HTTPS if the server hosts a website
• Step 4. Open only the ports you truly need
• Step 5. Enable UFW
• Step 6. Verify default policy
• Step 7. Review and remove unnecessary rules
• Docker note
• Common mistakes
• Conclusion
• What infrastructure fits this use case

UFW is a simple firewall interface for Ubuntu. On a VPS, it is useful because it lets you close unnecessary ports quickly, keep only the required access paths open, and reduce the risk of exposing services unintentionally.

The biggest mistake with UFW is enabling it before understanding which ports your server actually needs. That can lock you out of SSH or break a live service. The safer approach is to configure it step by step.

What to check first

Before enabling UFW, make sure you know:

• how you currently access the server;
• which SSH port is in use;
• whether the project needs HTTP and HTTPS;
• whether any services use non-standard public ports;
• whether firewall rules are already managed elsewhere.

Step 1. Check whether UFW is installed

sudo ufw status verbose

If UFW is not installed, add it first:

sudo apt update
sudo apt install -y ufw

Step 2. Allow SSH before enabling the firewall

On the default SSH port:

sudo ufw allow OpenSSH

Or explicitly:

sudo ufw allow 22/tcp

If your server uses a custom SSH port, allow that port instead, for example:

sudo ufw allow 2222/tcp

Check rules:

sudo ufw status numbered

Step 3. Allow HTTP and HTTPS if the server hosts a website

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Step 4. Open only the ports you truly need

For example:

sudo ufw allow 8080/tcp
sudo ufw allow 8443/tcp

The goal is not to collect random exceptions, but to expose only what must be reachable externally.

Step 5. Enable UFW

sudo ufw enable

Then verify status:

sudo ufw status verbose

Step 6. Verify default policy

A good baseline for most VPS setups is:

sudo ufw default deny incoming
sudo ufw default allow outgoing

Step 7. Review and remove unnecessary rules

sudo ufw status numbered

To remove a rule by number:

sudo ufw delete <number>

Docker note

If you run Docker containers, remember that published container ports may interact with firewall expectations in ways that operators often overlook. For example:

docker run -d -p 8080:80 nginx

A container like this can make a service reachable from outside, so Docker and firewall rules should be reviewed together.

Common mistakes

1. Enabling the firewall before allowing SSH.
2. Opening extra ports “just in case”.
3. Not checking which services are actually listening.
4. Ignoring Docker’s impact on exposed ports.
5. Letting old rules accumulate without cleanup.

Conclusion

UFW is a practical baseline firewall for Ubuntu VPS environments when it is used deliberately. Open SSH first, allow only the services you actually need, enable the firewall, and keep the rule set readable.

What infrastructure fits this use case