Quick answer: Ubuntu ships with UFW (Uncomplicated Firewall). Allow SSH first, then your service ports, then enable it:
ufw allow OpenSSH
ufw allow 80,443/tcp
ufw enable
ufw statusOverview
A firewall limits which network ports of your VPS are reachable from the internet. On Ubuntu the friendly front-end is UFW — simple rules on top of nftables/iptables. The golden rule: deny everything by default, allow only what you actually run. This article covers the Ubuntu basics; for app profiles, rate limiting and logging see the deeper UFW guide.
Before you start
- Root or sudo SSH access.
- The list of ports your server must serve (e.g. 22 SSH, 80/443 web, 25/587 mail).
- Critical: know that enabling a firewall without allowing SSH first cuts you off.
Step-by-step guide
- Install UFW if missing (present by default on Ubuntu):
apt update && apt install -y ufw - Set sane defaults:
ufw default deny incoming ufw default allow outgoing - Allow SSH before anything else:
ufw allow OpenSSH - Allow your services:
ufw allow 80,443/tcp # web ufw allow 3306/tcp # MySQL — only if it must be public (usually it should NOT be) - Enable and verify:
ufw enable ufw status verbose
Common issues
- Locked out? Use the KVM Console on your service page, log in locally and run
ufw allow OpenSSH(orufw disable), then reconnect. - Custom SSH port? Allow that port explicitly, e.g.
ufw allow 2222/tcp, before enabling. - Service unreachable after enabling? Check
ufw status— the port probably isn't allowed yet.
When to contact support
Firewall rules inside the OS are yours to manage on an unmanaged VPS, but if you're locked out and the console doesn't help, open a support ticket.
Frequently asked questions
Is UFW installed by default on Ubuntu?
Yes on Ubuntu Server (though disabled until you enable it). If missing, install with apt install ufw.
What must I allow before enabling UFW?
SSH — run ufw allow OpenSSH first, otherwise the moment you enable the firewall you lose your connection.
I locked myself out — what now?
Open the KVM Console from your service page, log in locally and run ufw allow OpenSSH or ufw disable.
Related articles
Need a hand? Contact Cloud2Y support →
