UFW (Uncomplicated Firewall) is a friendly front-end to the Linux netfilter firewall, standard on Ubuntu and Debian. Instead of writing raw iptables rules, you say things like 'allow 443' and UFW handles the rest. It's the quickest way to a sane default-deny firewall.

Why must I allow SSH before enabling UFW?

Because the moment you enable a default-deny firewall, any port that isn't explicitly allowed is blocked — including port 22. If you enable UFW without allowing SSH first, your current connection survives but your next login is refused, and you're locked out. Always run 'ufw allow OpenSSH' (or 'ufw allow 22/tcp') before 'ufw enable'.

Which ports should I open?

Only the ones you actually use. SSH (22) to manage the box; 80 and 443 if you run a website or reverse proxy; and whatever specific ports your app needs. Everything else stays closed. The fewer open ports, the smaller your attack surface.

Does UFW protect against everything?

No — it controls which ports accept connections, which is a big part of the job, but it doesn't inspect traffic on ports you've opened. Pair it with SSH keys, fail2ban for brute-force protection, and keeping software patched. A firewall is one layer, not the whole wall.

How do I check what's currently allowed?

Run 'sudo ufw status verbose'. It lists every active rule and whether UFW is enabled. Check it after any change so you always know exactly what's open.

How to configure a UFW firewall on a VPS

Set up a simple, effective firewall with UFW: allow SSH first (so you don't lock yourself out), open only the ports you need, and enable it. A clean default-deny firewall in a handful of commands.

A firewall decides which ports on your server accept connections from the outside. Everything you don't explicitly open should be closed — that's default-deny, and it shrinks your attack surface to just the services you actually run. UFW makes this simple. The one thing to get right is the order: allow SSH before you turn the firewall on, or you'll lock yourself out.

1. Install UFW (usually already present)

sudo apt update && sudo apt install -y ufw

2. Allow SSH FIRST — before anything else

This is the step that prevents a lockout. Do it before enable:

sudo ufw allow OpenSSH
# or, if you use a custom SSH port:
# sudo ufw allow 22/tcp

3. Open only the ports you need

sudo ufw allow 80/tcp     # HTTP, if you serve a website
sudo ufw allow 443/tcp    # HTTPS
# add app-specific ports only as needed, e.g.:
# sudo ufw allow 51820/udp   # WireGuard VPN

4. Set default policy and enable

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable           # asks for confirmation

5. Verify

sudo ufw status verbose

You should see SSH and your chosen ports allowed, everything else denied. Check this after every change.

Common tasks

sudo ufw allow 3000/tcp        # open a port
sudo ufw delete allow 3000/tcp # close it again
sudo ufw status numbered       # list rules with numbers
sudo ufw delete 2              # delete rule #2
sudo ufw disable               # turn the firewall off

Honest cautions

Allow SSH before ufw enable. This is the single mistake that locks people out of their own server. If it happens, a provider console gets you back in — EQVPS gives every VPS a browser console.
A firewall is one layer. It controls open ports, not what happens on them. Combine it with SSH key authentication and fail2ban.
On NAT plans, inbound ports work differently — a firewall on the box still helps, but only a dedicated-IP plan accepts arbitrary inbound.

Next steps

A firewall plus keys is most of a hardened box. Finish with the new-VPS security checklist. Opening 443 for a web app? See how to set up an nginx reverse proxy with HTTPS.