Install UFW on Ubuntu and Debian: Safe Setup

To install UFW on Ubuntu or Debian, open a terminal and run sudo apt update, then sudo apt install ufw. Before enabling it on a remote machine, allow SSH (or your actual remote-access port) so the firewall does not lock you out.

What UFW Does

UFW, short for Uncomplicated Firewall, is a command-line interface for managing firewall rules on Linux systems that use the underlying packet-filtering framework. It lets you express common rules in readable commands, such as allowing a service or denying traffic from an address. It is a management tool, not a separate network firewall appliance.

Ubuntu commonly includes UFW, though it may be inactive; Debian installations may not have it installed. The package is available from the standard APT repositories on supported releases. UFW can manage IPv4 and IPv6 rules, subject to the system’s configuration. Installing the package does not automatically mean that filtering is active: check its status before and after making changes.

Install UFW with APT

Run these commands in a terminal:

Refresh the package index: sudo apt update.
Install the package: sudo apt install ufw.
Confirm the command is available: ufw version.

APT may ask you to confirm the installation. If the command is not found, check for spelling errors and verify that your package lists and configured repositories are working. On a minimal server, make sure you have administrative access through sudo or a root shell. Avoid downloading a random package file: the normal distribution repositories are the straightforward installation route.

To see whether UFW is already active, run sudo ufw status verbose. If the output says Status: inactive, rules can be prepared without filtering being enabled. If it is active already, inspect its existing rules before changing defaults or adding new ones.

Allow Access Before Enabling

The most important setup detail is allowing the access you need before turning on the firewall. For a remote server managed over SSH, use the SSH application profile if available:

sudo ufw app list
sudo ufw allow OpenSSH

The profile name is case-sensitive in practice as shown by the list; use the name your system displays. Alternatively, allow the port and protocol actually used by your SSH service. The conventional SSH port is 22, but administrators may configure a different one. For example, to allow TCP port 22, the rule is sudo ufw allow 22/tcp. Do not assume that port 22 is correct without checking your server configuration.

Allow other services only when the machine needs to accept them. For example, a web server might need inbound TCP traffic on ports 80 and 443. UFW accepts rules by service profile, port, protocol, and in some cases source address. Check your application and network design rather than opening broad ranges by default.

If you are connected remotely, keep the current session open while enabling UFW and test a second connection in another terminal. This gives you a chance to spot a bad rule before closing your working session. If you have a hosting-provider console or other out-of-band access, know how to use it before changing firewall settings.

Set Defaults and Enable the Firewall

A common baseline for a machine that initiates connections to other systems but only serves explicitly allowed services is to deny unsolicited incoming connections and allow outgoing connections:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable

When prompted, confirm that you want to proceed. The default policies are not universal requirements: a host that must accept particular traffic needs appropriate allow rules, and a system with special routing or forwarding duties may need additional configuration. UFW’s standard host-firewall setup is not a substitute for understanding those requirements.

Verify the result with:

sudo ufw status verbose
sudo ufw status numbered

The verbose output shows whether the firewall is active and displays default policies. The numbered output makes it easier to identify individual rules. You can also inspect application profiles with sudo ufw app info OpenSSH, replacing the profile name with one listed on your system.

Manage Rules and Make Changes

Rules can be added or removed later. For example, to allow HTTPS by its service profile, first check that the profile exists with sudo ufw app list, then use sudo ufw allow 'WWW Full' if that is the profile name provided. A direct protocol-and-port rule, such as sudo ufw allow 443/tcp, avoids relying on a profile name.

To remove a rule, use its exact rule expression, such as sudo ufw delete allow 443/tcp, or refer to the number shown by sudo ufw status numbered, for example sudo ufw delete 2. Rule numbers can change after deletions, so check the current list before removing a numbered entry. If you need to start over, sudo ufw reset removes configured rules and disables UFW; review the confirmation carefully because this can remove access rules you still need.

UFW changes usually take effect when commands are applied; a system reboot is not normally required just to enable or adjust its rules. Still, verify connectivity for the services you intend to expose, and remember that cloud-provider firewalls, routers, or other filtering layers can also block traffic.

Common Problems and Safety Checks

SSH stops responding: A missing allow rule or a port mismatch is a likely cause. Use the provider console or local access to inspect sudo ufw status and add the correct rule.
A service is unreachable: Confirm that the application is running and listening on the expected address and port. Then check UFW, any upstream firewall, and the client’s network path. An allow rule cannot make a stopped service listen.
IPv6 behaves differently: Check /etc/default/ufw for the IPv6 setting and review the rules and system network configuration. Do not assume that an IPv4 rule alone covers every IPv6 case.
Rules seem duplicated or confusing: Inspect the numbered status and remove obsolete rules deliberately. Avoid resetting a production firewall just to tidy it without recording the access you need.
APT cannot install the package: Check the network connection, repository configuration, and the output of sudo apt update. Resolve repository or release-support issues rather than adding an untrusted source.

A firewall rule controls network traffic; it does not patch software, authenticate users, or replace service-level security. Keep applications updated, expose only required services, and avoid treating a successful UFW status message as proof that the whole system is secure.

Frequently Asked Questions

Is UFW installed by default on Ubuntu?
UFW is commonly available on Ubuntu and may already be installed, but its active state can vary. Check with sudo ufw status verbose; install it with APT if the command is unavailable.

Does installing UFW enable it automatically?
Installing the package is separate from enabling the firewall. Check its status, configure the necessary allow rules, and then run sudo ufw enable when ready.

How do I install UFW on Debian?
Update APT’s package index with sudo apt update, install using sudo apt install ufw, and then configure and enable it as needed. Package availability depends on the configured repositories.

Will enabling UFW disconnect my SSH session?
It can block new remote connections if SSH is not allowed or the rule uses the wrong port. Add and verify the correct SSH rule before enabling, and keep a recovery route available.

How can I disable UFW temporarily?
Run sudo ufw disable. This turns off UFW filtering; use it only when intended, and re-enable it with sudo ufw enable after addressing the issue.

Is UFW enough to secure a server?
No. It helps control network access, but server security also depends on updates, secure service configuration, authentication, monitoring, and any network controls outside the machine.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →