Home › Root servers › Firewall with ufw

Firewall with ufw

Open only the required ports.

The SSH rule must be set before ufw enable. Otherwise you lock yourself out.

Set the default rules:

sudo ufw default deny incoming
sudo ufw default allow outgoing

Allow SSH (adjust if you changed the SSH port):
```
sudo ufw allow OpenSSH
```
Add only the services you need, e.g. a web server:
```
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
```
Enable and check:
```
sudo ufw enable
sudo ufw status verbose
```

Why a firewall directly on the VM?

Second layer of protection: The firewall of the host or network may be misconfigured or missing. The rules on the VM still apply.
Smaller attack surface: Services that accidentally listen on all addresses (e.g. a database) cannot be reached from outside.
Protection against scans and brute force: Closed ports are not answered at all. Combined with fail2ban, only the necessary access stays open.

SSH (port 22 or your changed port): Always allow before ufw enable. Otherwise the server can no longer be reached without console access. If you changed the port, open exactly that port, not 22.
80 and 443 (HTTP/HTTPS): For websites and certificates. Let's Encrypt checks domains via port 80; if you block 80, certificates can no longer be renewed.
Outgoing traffic: Do not block it, otherwise updates, DNS (53), NTP (123) and outgoing HTTPS connections stop working. That is why default allow outgoing is set.
ICMP (ping): Do not block it completely. Without ICMP for "fragmentation needed", larger packets cause connection problems.
Game ports: Many games need UDP and TCP on several ports. Check the game's documentation before blocking anything, otherwise players lose their connection.

The console (IPMI/KVM) does not go through ufw. It therefore remains reachable even with a wrong firewall rule, see IPMI and console.

Docker containers often publish ports past ufw. If you use Docker, check this separately. For game ports, only open the ports the game really needs.