Every service listening on your server is reachable by the whole internet unless a firewall says otherwise. UFW (Uncomplicated Firewall) is Ubuntu's built-in, human-friendly front end to the kernel's netfilter — and it lives up to the name: you can lock down an Ubuntu 24.04 server with five commands. This guide covers installation, sane defaults, opening ports, rate limiting, and the mistakes that lock people out.
Step 1 — Install UFW
UFW ships with Ubuntu Server by default; if it is missing:
sudo apt update sudo apt install ufw -y
Step 2 — Set the default policies
The golden rule of firewalls: deny everything inbound, allow everything outbound, then punch specific holes:
sudo ufw default deny incoming sudo ufw default allow outgoing
Step 3 — Allow SSH before anything else
sudo ufw allow OpenSSH
If SSH runs on a custom port (see our SSH hardening guide), allow that instead: sudo ufw allow 2222/tcp.
Step 4 — Open the ports your services need
sudo ufw allow 80/tcp # HTTP sudo ufw allow 443/tcp # HTTPS sudo ufw allow 3306/tcp # MySQL — only if remote access is really needed
You can also allow by application profile (sudo ufw app list shows what is registered — e.g. “Nginx Full” after installing Nginx), restrict a rule to one source IP:
sudo ufw allow from 198.51.100.7 to any port 22 proto tcp
Step 5 — Enable the firewall
sudo ufw enable sudo ufw status verbose
Rate limiting — UFW's hidden gem
Replace a plain allow rule with limit and UFW will temporarily ban IPs that make more than 6 connections in 30 seconds — a lightweight brute-force shield that pairs well with Fail2Ban:
sudo ufw limit OpenSSH
Managing rules
List rules with numbers and delete by number:
sudo ufw status numbered sudo ufw delete 3
Disable temporarily with sudo ufw disable; wipe everything and start over with sudo ufw reset. Logs land in /var/log/ufw.log (enable with sudo ufw logging on).
Frequently asked questions
Does UFW protect against DDoS attacks?
No host firewall can absorb a real volumetric DDoS — that requires upstream filtering at the network level. UFW protects against unauthorized access, port scans and light abuse. If you are facing sustained attacks, talk to us about protected hosting.
UFW or iptables/nftables directly?
UFW is iptables/nftables under the hood — it just writes the rules for you. For a typical web or application server there is no practical downside to using UFW.
Related Ubuntu guides
- Initial Ubuntu 24.04 Server Setup Guide: Secure Your New VPS in 10 Steps
- How to Secure SSH on Ubuntu: Key Authentication, Custom Port and Best Practices
- How to Install Fail2Ban on Ubuntu 24.04 to Stop Brute-Force Attacks
- How to Install a LEMP Stack (Nginx, MySQL, PHP) on Ubuntu 24.04
Prefer to have experts handle it?
LFA IT provides fully managed Ubuntu VPS and dedicated servers — initial setup, security hardening, monitoring and 24/7 support, so you can focus on your business. Explore our hosting and server management services or open a support ticket and our engineers will take it from there.
