Configuring a software firewall with UFW

Why use a firewall?

By default, all inbound ports on your VPS are open to the internet. A firewall limits exposure to only the ports your applications need.

Installing and enabling UFW

apt install ufw           # Debian / Ubuntu
ufw default deny incoming
ufw default allow outgoing

⚠️ Before enabling, make sure you allow SSH — otherwise you will lock yourself out.

ufw allow ssh             # or: ufw allow 22/tcp
ufw enable
ufw status verbose

Common rules

# Web server
ufw allow 80/tcp
ufw allow 443/tcp

# Mail server
ufw allow 25/tcp     # SMTP
ufw allow 587/tcp    # Submission
ufw allow 993/tcp    # IMAPS

# Custom port
ufw allow 8080/tcp

# Allow from a specific IP only
ufw allow from 203.0.113.10 to any port 22

# Delete a rule
ufw delete allow 8080/tcp

Rate limiting SSH to prevent brute-force

ufw limit ssh comment 'Rate-limit SSH'

This allows a maximum of 6 connections from the same IP in 30 seconds, then blocks temporarily.

Viewing logs

ufw logging on
tail -f /var/log/ufw.log

Resetting UFW

If you make an error and get locked out, use the VNC Console to log in and run:

ufw disable
ufw reset