How to configure UFW firewall

Quick answer: Beyond ufw allow, UFW supports app profiles (ufw app list), source-restricted rules (ufw allow from 198.51.100.5 to any port 22), brute-force rate limiting (ufw limit OpenSSH) and logging (ufw logging on). Rules survive reboots automatically.

Overview

This is the practical UFW toolbox for a production VPS: precise rules, per-application profiles, protecting the SSH port with rate limiting, and reading the logs. If you're brand new to UFW, start with the Ubuntu firewall basics first. UFW works the same on Debian; on AlmaLinux/Rocky the native tool is firewalld instead.

Before you start

• UFW installed with SSH already allowed (see the basics).
• A static IP of your office/home, if you want source-restricted admin access.

Step-by-step guide

1. Application profiles — packages register named profiles:

   ufw app list
   ufw app info "Nginx Full"
   ufw allow "Nginx Full"

2. Restrict a port to specific sources (e.g. SSH only from your IP):

   ufw allow from 198.51.100.5 to any port 22 proto tcp

3. Rate-limit SSH — bans IPs making 6+ connections in 30 seconds:

   ufw limit OpenSSH

4. Delete or review rules by number:

   ufw status numbered
   ufw delete 3

5. Logging:

   ufw logging on
   tail -f /var/log/ufw.log

6. Reset and start over (careful — removes all rules):

   ufw reset

Common issues

• Rule seems ignored? UFW processes rules in order — check ufw status numbered; a broad allow above a narrow deny wins.
• Docker publishes ports around UFW. Docker manipulates iptables directly — published container ports may bypass UFW rules; bind containers to 127.0.0.1 when they shouldn't be public.
• IPv6 unprotected? Ensure IPV6=yes in /etc/default/ufw so rules apply to IPv6 too.

When to contact support

If you've locked yourself out and the KVM Console isn't enough to recover, or you see attack traffic the firewall can't absorb, open a support ticket — DDoS protection is available as a service option.

Frequently asked questions

What does ufw limit do?

It rate-limits connections — an IP making 6 or more attempts within 30 seconds is temporarily blocked. Ideal for SSH.

Does UFW protect Docker containers?

Not fully — Docker writes its own iptables rules, so published ports can bypass UFW. Bind private containers to 127.0.0.1.

Does UFW cover IPv6?

Yes when IPV6=yes is set in /etc/default/ufw (default on modern Ubuntu) — rules are applied to both stacks.

Related articles

• How to configure firewall on Ubuntu
• How to install Fail2ban
• How to secure SSH access
• How to secure your VPS after deployment

Need a hand? Contact Cloud2Y support →