How to Configure UFW for Specific Ports on Ubuntu

UFW — Uncomplicated Firewall — is the friendly front-end to iptables/nftables on Ubuntu. The default-deny + allow-only-what-you-need pattern stops 99 percent of internet noise from ever touching your services.

Prerequisites

• Ubuntu 22.04 or 24.04 with sudo.
• An open SSH session you can keep alive while you change rules.
• A clear list of the ports your services actually listen on (sudo ss -tulpn).

Step 1: Confirm UFW is installed and its state

sudo apt install -y ufw
sudo ufw status verbose

If it says inactive, set policy and your SSH allow before you enable it — locking yourself out is annoying.

Step 2: Set default-deny policy

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw default deny routed

Step 3: Allow your management ports first

Always allow SSH before enabling:

sudo ufw allow 22/tcp comment 'ssh'
# If you moved SSH off 22:
# sudo ufw allow 2222/tcp comment 'ssh-alt'

Step 4: Open specific service ports

Typical web host:

sudo ufw allow 80/tcp  comment 'http'
sudo ufw allow 443/tcp comment 'https'

Source-restricted DB access (only your app server):

sudo ufw allow from 10.0.1.20 to any port 5432 proto tcp comment 'postgres from app'

Rate-limited SSH (drops brute-force traffic):

sudo ufw limit 22/tcp comment 'ssh rate-limited'

Custom port range for a service:

sudo ufw allow 30000:30100/tcp comment 'agent port range'

Step 5: Enable and verify

sudo ufw enable
sudo ufw status numbered

The numbered listing is what you use to delete a rule later:

sudo ufw delete 5

Step 6: Logging

sudo ufw logging medium
sudo tail -f /var/log/ufw.log

medium is enough for most ops — low skips allow logs, high logs everything (noisy).

Verify

sudo ufw status verbose
sudo iptables -L INPUT -n | head -20     # underlying iptables view
nmap -Pn -p 22,80,443,3306 your.host     # from a workstation

nmap should show only the ports you allowed as open; the rest as filtered.

Conclusion

UFW gives you readable rules without forcing you to learn iptables syntax — but the iptables/nftables chains are right there if you need to debug. Apply default-deny once and you can leave it alone for years.

Next steps

• Pair UFW with Fail2ban to drop scanners automatically.
• Audit listeners regularly with systemd service management.
• For RHEL family servers, see the firewalld zones guide.