Set up a ufw firewall on a Linux/Ubuntu server: step-by-step guide | ComputeBox
VPS & Server
How to set up a firewall with ufw on Linux/Ubuntu
With ufw you control which ports of your server are reachable from outside in just a few commands. Here is how to set up a sane default firewall without locking yourself out.
A firewall decides which ports of your server are reachable from outside. Anything you do not need stays closed. On Linux, ufw (Uncomplicated Firewall) is the simplest way to get there. This guide takes you to a sensible default setup in a few commands, without accidentally locking yourself out.
8 minBeginnerTested on Ubuntu 24.04Updated 2026-06-17
In short
Deny everything incoming, allow outgoing, then specifically allow SSH and your web ports, and enable the firewall.
A host firewall controls which of your services are visible to the outside at all. If a database only runs locally, its port does not need to be open on the internet. A short allow list shrinks your attack surface significantly.
A panel firewall is on the way
A firewall directly in the panel is in preparation. Until then you set up protection at the operating system level as shown here. The two combine cleanly later.
The ground rule of any good firewall: block everything incoming, allow everything outgoing. Nothing is reachable from outside at first, and you open up only what you need.
Always allow SSH first, otherwise you lock yourself out when enabling. If it happens anyway, you get back in through the VNC console in the panel.
OpenSSH is a predefined profile for port 22. You only need ports 80 and 443 if a website or a reverse proxy runs on the server. Leave them out if you do not use them.
You can add a new rule at any time, for example for your own service on port 8080:
To remove one, list the rules numbered and delete the right number:
Restrict access further
You can limit ports to specific addresses. sudo ufw allow from 203.0.113.10 to any port 22 allows SSH only from one fixed IP. Handy if you have a static office or home address.
Port 25 for outgoing mail is blocked at the network level at ComputeBox and cannot be opened with ufw. On request and after a quick check we unblock it per server. Ports 465 and 587 for mail submission are open.
