---
title: ufw — simple firewall management
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: A firewall tool that makes iptables easy to use. Used for allowing/blocking ports and checking rules.
tags: program, Network and Firewall, ufw
---

**💬 "ufw command"**

ufw manages iptables with **human-readable rules**. It sets default policies and allowed ports.

Before making changes, it’s important to check the current rules with `status`.

- **Concept**: Manages firewall rules (allow/deny).
- **status verbose**: Shows current rules and default policies.
- **allow/deny**: Allows or blocks ports or services.
- **Default policy**: incoming deny, outgoing allow is typical.
## Frequently used options

| Option | Description |
| --- | --- |
| allow <port> | Allows that port |
| delete allow <port> | Deletes an allow rule |
| status verbose | Checks rules and default policies |
| limit <port> | Limits connection attempts (mitigates brute force) |

## Three essential command combinations

- `ufw status verbose` — Check current rules (required before changes)
- `ufw allow 443/tcp` — Allow the HTTPS port
- `ufw limit 22/tcp` — Limit SSH connection attempts
**💬 "Tell me the order to use when setting up a new server"**

Here are common situations on production servers, arranged in order.

### Step 1 · Check current rules

Check open ports and policies.

```
ufw status verbose
```

### Step 2 · Allow only necessary ports

Open only the minimum service ports.

```
ufw allow 443/tcp
```

### Step 3 · Apply and verify

Check status and actual connectivity.

```
ufw status | grep 443 && curl -sI https://example.com | head -1
```

## How this is used in practice

### 1. Open a web port

**Situation** — A new service needs to be served on 443.

```
ufw allow 443/tcp && ufw status | grep 443
```

**Result** — The rule is added and the service becomes accessible from outside.

**Key point** — If you haven’t checked the SSH port first, you can lose remote access.

### 2. Clean up unnecessary ports

**Situation** — An old port 8080 is open.

```
ufw status | grep 8080 && ufw delete allow 8080/tcp
```

**Result** — The rule is removed, reducing exposure.

**Key point** — Remove rules only after verifying service impact.

## Things to watch out for

- If the default policy is deny immediately after enable, remote access can be lost when there is no SSH rule.
- Because ufw runs on top of iptables/nftables, it can conflict with container networking.
- Rule changes affect production, so they require prior review and approval.
## Actual output

This is the result of checking firewall rules and default policies.

![ufw command output: firewall rules](https://games.aidebatehub.com/assets/ufw-demo.png)

Production server

---
Source (HTML): https://games.aidebatehub.com/programs/linux/network/ufw.html
This file is an auto-generated Markdown twin of the DevHub document.