UFW manages the firewall inside a Linux VPS. This guide covers a basic Debian/Ubuntu server using SSH.
Enabling UFW can interrupt an existing SSH connection. Allow your actual SSH port first and keep the VNC console available until you have tested a new login. Do not reset an existing firewall without reviewing the services and rules it protects. Install and inspect UFW
If UFW is already active, review its current rules before changing defaults. Do not manage the same rules independently with UFW, raw iptables commands, and another firewall manager.
Allow SSH before enabling UFW
For a new, basic configuration:
Replace 22 with your actual SSH port. Add rules for any other services you need before enabling UFW. For example, a web server normally needs:
Then enable and inspect the firewall:
Open a second SSH connection from your computer and confirm it works before closing your original session. Also test required application ports. Review IPv6 rules as well as IPv4 rules if the VPS uses both address families.
The UFW manual explains why allowing SSH before activation matters.
Restrict a service to a trusted address
For example, allow SSH only from a known administrator address:
Replace the documentation address and port with your own. Adding this rule does not remove an existing rule that allows everyone. Test from the trusted address, then remove the broader rule if you intend to restrict access. Account for your own IPv6 address and changes to your home or office IP.
Review and remove rules
Remove a rule by its displayed number, replacing 3 with the correct number:
List the rules again after each deletion because their numbers change. IPv4 and IPv6 entries may be separate.
Recover from a blocked connection
Use the VNC console to inspect sudo ufw status numbered and add or correct the required access rule. Once a new SSH connection works, remove any temporary rule you no longer need.
sudo ufw disable stops UFW filtering; use it only when you deliberately need that temporary state. sudo ufw reset removes your configured rules and is not a routine connectivity fix.
For more examples, see Basic UFW setup. Last modified on September 30, 2026
