sodcalculator

10 Tech How-To

Enable or Disable Firewall on Ubuntu: Step-by-Step

Guide 10-35991 · Updated · Step by step

This guide shows you how to turn the Ubuntu firewall (UFW – Uncomplicated Firewall) on or off, check its status, and manage basic rules. You’ll need a terminal and sudo access to make changes.

What You’ll Need

  • A computer running Ubuntu (any recent version, e.g., 20.04, 22.04, or 24.04)
  • Terminal access (Ctrl+Alt+T opens it)
  • Sudo privileges (your user must be in the sudo group)

Step-by-Step

  1. Check if UFW is installed. Most Ubuntu installations include UFW, but verify with: sudo ufw status. If you see Command 'ufw' not found, install it with sudo apt update && sudo apt install ufw.
  2. Check the current status. Run sudo ufw status verbose. This shows whether the firewall is active or inactive, and lists any rules. If it says Status: inactive, the firewall is off.
  3. Enable the firewall. To turn it on, run: sudo ufw enable. You’ll be warned that this may disrupt existing connections. Type y and press Enter. The firewall will start and automatically load at boot.
  4. Allow essential services before enabling (recommended). If you’re enabling for the first time, add rules for SSH (port 22) so you don’t lock yourself out: sudo ufw allow ssh. For a web server, also run sudo ufw allow http and sudo ufw allow https. Do this before step 3 if you’re on a remote machine.
  5. Disable the firewall. To turn it off, run: sudo ufw disable. This stops the firewall and removes it from startup. It does not delete your rules; they remain configured for when you re-enable.
  6. Verify the change. After enabling or disabling, run sudo ufw status again. It should show Status: active or Status: inactive as expected.
  7. Reset to default (optional). If you want to remove all rules and start fresh, use sudo ufw reset. This disables the firewall and deletes all rules. You’ll be asked to confirm.

Common Mistakes

  • Enabling without allowing SSH – If you’re connected remotely, enabling UFW with no allow rule for port 22 will cut your connection. Always add sudo ufw allow ssh first.
  • Forgetting sudo – UFW commands require root privileges. Running ufw enable without sudo gives a permissions error.
  • Confusing enable with status – ufw enable turns the firewall on; ufw status only shows whether it’s on. They are not interchangeable.
  • Assuming the firewall is off when it’s not – Some cloud images come with UFW active by default. Always check status before assuming.
  • Using the wrong interface – If you have a GUI firewall tool like Gufw, changes there may not reflect immediately in the terminal. Stick to one method.

Tips

  • Use sudo ufw status numbered to see rules with numbers, making it easy to delete specific ones with sudo ufw delete NUMBER.
  • Allow a specific port by number, e.g., sudo ufw allow 8080 (TCP and UDP). For TCP only, use sudo ufw allow 8080/tcp.
  • Deny a port with sudo ufw deny 23 to block telnet, for example.
  • Check logs at /var/log/ufw.log to see blocked connection attempts.
  • If you’re testing, enable and then disable quickly to avoid locking yourself out.

Troubleshooting

Command not found
Install UFW with sudo apt update && sudo apt install ufw.

Permission denied
Make sure you have sudo access. Run sudo -i to become root, or prefix every command with sudo.

I enabled the firewall and lost SSH connection
If you’re locked out, you need physical or out-of-band access (e.g., a cloud provider’s web console). Log in locally, then run sudo ufw allow ssh and sudo ufw enable (or just sudo ufw allow ssh if the firewall is still on).

Firewall doesn’t start at boot
Ensure the service is enabled: sudo systemctl enable ufw. Also check that UFW isn’t masked: systemctl status ufw should show active.

Status shows “inactive” but I thought I enabled it
Run sudo ufw enable again. If it says “Firewall is active and enabled on system startup,” then it’s already on; the status might have been cached. Try sudo ufw status verbose.

I want to allow a service but don’t know the port
Use sudo ufw app list to see application profiles, then sudo ufw allow 'OpenSSH' for example.

Frequently Asked Questions

Does enabling UFW block all incoming traffic by default?
Yes, UFW’s default policy is to deny all incoming connections and allow all outgoing. This is safe for most users.

Will disabling UFW delete my rules?
No, disabling only turns the firewall off. Your rules are saved and will be reapplied when you enable it again.

How do I check if UFW is running?
Run sudo ufw status. If it says “Status: active,” it’s running. You can also check systemctl status ufw.

Is UFW the same as iptables?
UFW is a front-end for iptables. It makes managing firewall rules easier, but underneath it uses iptables.

Can I enable UFW without sudo?
No, you need root privileges. Use sudo or log in as root (not recommended).

What does “sudo ufw reset” do?
It disables the firewall and deletes all rules, returning to the default state. Use it if you want a clean slate.

Related

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →