ufw Command in Linux: Configure the Firewall

Quick take: The ufw command (Uncomplicated Firewall) is Ubuntu's easy front end to the firewall. Allow a service with sudo ufw allow OpenSSH, enable it with sudo ufw enable, and review rules with sudo ufw status.

Introduction

The ufw command (Uncomplicated Firewall) is Ubuntu's friendly front end to the powerful but complex iptables/nftables firewall. It lets you allow and deny traffic by port or service name with simple, readable commands, making host-level firewalling approachable.

This guide covers enabling the firewall without locking yourself out, allowing and denying traffic, setting default policies, and checking the current rules.

Syntax

The basic syntax of the ufw command is:

ufw [OPTIONS] COMMAND

Common Options and Parameters

The most useful options and parameters for the ufw command:

Practical Examples

Real ufw commands you can run today:

# Allow SSH BEFORE enabling (avoid lockout!)
sudo ufw allow OpenSSH
# Enable the firewall
sudo ufw enable
# Check the rules
sudo ufw status verbose
# Allow HTTP and HTTPS
sudo ufw allow 80/tcp && sudo ufw allow 443/tcp
# Allow a port only from one IP
sudo ufw allow from 203.0.113.5 to any port 22
# Rate-limit SSH against brute force
sudo ufw limit OpenSSH
# Delete a rule
sudo ufw delete allow 80/tcp

Tips and Best Practices

• Always allow SSH before enabling ufw on a remote server — sudo ufw allow OpenSSH first, or you will lock yourself out.
• Set safe defaults with sudo ufw default deny incoming and sudo ufw default allow outgoing.
• Use ufw limit on SSH to throttle repeated connection attempts and blunt brute-force attacks.

Final Thoughts

ufw makes host firewalling on Ubuntu genuinely simple — allow and deny by port or service in one readable line. The cardinal rule on a remote server is to allow SSH before enabling, then set deny-incoming defaults and open only what you need. For complex rule sets, ufw sits on top of iptables, which you can still use directly when required.