The firewall for Ubuntu and Debian (UFW) in a few commands. Always allow SSH first before you turn on the firewall, or you’ll lock yourself out.
On and off
The status and all rules
sudo ufw status verbose
Rules with numbers
sudo ufw status numbered
Turn on the firewall
sudo ufw enable
Turn off the firewall
sudo ufw disable
Reload all rules
sudo ufw reload
Reset everything (watch out!)
sudo ufw reset
Default rules
Block everything from outside
sudo ufw default deny incoming
Allow everything to outside
sudo ufw default allow outgoing
Allow
Allow SSH
sudo ufw allow ssh
Allow a port
sudo ufw allow 80/tcp
Multiple ports at once
sudo ufw allow 80,443/tcp
A UDP port (for example WireGuard)
sudo ufw allow 51820/udp
Only from your home network
sudo ufw allow from 192.168.1.0/24 to any port 22
Traffic from your Tailscale interface
sudo ufw allow in on tailscale0
Allow SSH with protection against attacks (rate limit)
sudo ufw limit ssh
Block and remove
Block a port
sudo ufw deny 23
Remove a rule by name
sudo ufw delete allow 80/tcp
Remove a rule by number (see numbered)
sudo ufw delete 3
Log
Turn on logging
sudo ufw logging on
Read the log
sudo tail -f /var/log/ufw.log
Good to know
Running Docker? Ports you publish with -p or ports: bypass UFW. Restrict them with 127.0.0.1:8080:80 instead of 8080:80, or configure it in the Docker settings.
Test rules from another computer with our port checker (for TCP ports) and keep a second SSH session open while making changes.
Sources and attribution
This overview is compiled in our own words. Commands and options change per version: when in doubt, check the official documentation.