How To Configure Firewall with UFW on Ubuntu 20.04 LTS

How do I set up and configure firewall with UFW on Ubuntu 20.04 LTS server?

UFW is an acronym for an uncomplicated firewall. Securing a network with an uncomplicated firewall is super easy and highly recommended. This page explains how to set up and secure your Ubuntu 20.04 LTS server with ufw.
Tutorial requirements
Operating system/appUbuntu Linux 20.04 LTS
Root privileges required Yes
Difficulty Easy (rss)
Estimated completion time 15m
Table of contents

Step 1 – Set Up default UFW policies

To view status of ufw, type:
sudo ufw status
Sample outputs:

Status: inactive

The default policy firewall works out great for both the servers and desktop. It is always a good policy to closes all ports on the server and open only required ports one by one. Let us block all incoming connection and only allow outgoing connections from the Ubuntu 20.04 LTS box:
sudo ufw default allow outgoing
sudo ufw default deny incoming

Enabling IPv6 support

Make sure the directive IPV6=yes do exists in /etc/default/ufw file. For instance:
cat /etc/default/ufw

Step 2 – Open SSH TCP port 22 connections

The next logical step is to allow incoming SSH ports. We can easily open SSH TCP port 22 using UFW as follows:
sudo ufw allow ssh
If you are running ssh on TCP port 2222 or TCP port 2323, enter:
sudo ufw allow 2222/tcp
sudo ufw allow 2323/tcp

Some sysadmins have a static IP address (such as at home or office location. In that case, only allow ssh access from the static IP address such as to Ubuntu server IP address
sudo ufw allow proto tcp from to port 22
Let us limit ssh port, run:
sudo ufw limit ssh
See “How to limit SSH (TCP port 22) connections with ufw on Ubuntu Linux” for more information.

Step 3 – Turn on firewall

Now we got basic configuration enabled. In other words, the firewall will drop all incoming traffic except for ssh TCP port 22. Let us true it on the UFW, enter:
sudo ufw enable

Remember, once UFW enabled, it runs across system reboots too. We can verify that easily as follows using the systemctl command:
sudo systemctl status ufw.service

Want to disable the UFW based firewall? Try

If you need to stop the firewall and disable on system startup, eenter:
sudo ufw disable
Sample outputs:

Firewall stopped and disabled on system startup

Step 4 – Open specific incoming connections/ports

Let us add more rules. Say you want to open ports and allow IP address with ufw. The syntax is as follows to open TCP port 80 and 443:
sudo ufw allow 80/tcp comment 'accept Apache'
sudo ufw allow 443/tcp comment 'accept HTTPS connections'

Open UDP/1194 (OpenVPN) server:
sudo ufw allow 1194/udp comment 'OpenVPN server'

Allow port ranges via ufw

We can allow port ranges too say, tcp and udp 3000 to 4000:
sudo ufw allow 3000:4000/tcp
sudo ufw allow 3000:4000/udp

In this example, you want to allow ALL connections from an IP address called, enter:
sudo ufw allow from
Let us allow connections from an IP address called to our port 25, enter:
sudo ufw allow from to any port 25 proto tcp
We can set dest IP for port 25 too:
sudo ufw allow from to port 25 proto tcp

Allow connection on specific interface

Open port 22 for wg0 interface only:
sudo ufw allow in on wg0 to any port 22
Say you want to allow connection for TCP port 3306 on lxdbr0 interface from, then add:
ufw allow in on lxdbr0 from to any port 3306 proto tcp
Let us add sub/net instead of single IP address:
ufw allow in on lxdbr0 from to any port 3306 proto tcp

Step 5 – Block and deny incoming connections/ports

Do you want to close ports and block certain IP addresses? The syntax is as follows to deny access. In other words, simply ignoring access to port 25:
sudo ufw deny 25/tcp
Make sure we deny all connections from an IP address called, enter:
sudo ufw deny from
Deny all connections from an IP/subnet called, enter:
sudo ufw deny from
Want to deny access to (say bad guys IP) on port 22? Try:
sudo ufw deny from to any port 22 proto tcp

Step 6 – Verify status of UFW

Use the status command as follows:
sudo ufw status

Status: active
To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere                  
80/tcp                     ALLOW       Anywhere                   # accept Apache
443/tcp                    ALLOW       Anywhere                   # accept HTTPS connections
1194/udp                   ALLOW       Anywhere                   # OpenVPN server
3000:4000/tcp              ALLOW       Anywhere                  
3000:4000/udp              ALLOW       Anywhere                  
Anywhere                   ALLOW             
25/tcp                     ALLOW     25/tcp     ALLOW             
Anywhere                   DENY                
Anywhere                   DENY            
22/tcp                     DENY                   
22/tcp (v6)                ALLOW       Anywhere (v6)             
80/tcp (v6)                ALLOW       Anywhere (v6)              # accept Apache
443/tcp (v6)               ALLOW       Anywhere (v6)              # accept HTTPS connections
1194/udp (v6)              ALLOW       Anywhere (v6)              # OpenVPN server
3000:4000/tcp (v6)         ALLOW       Anywhere (v6)             
3000:4000/udp (v6)         ALLOW       Anywhere (v6)

Want verbose outputs? Try:
sudo ufw status verbose

Ubuntu 20.04 LTS UFW delete rules

So far we learned how to add, deny, and list the firewall rules. It is time to delete unwanted rules. The syntax is as follows to list all of the current rules in a numbered list format:
sudo ufw status numbered

Status: active
     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere                  
[ 2] 80/tcp                     ALLOW IN    Anywhere                   # accept Apache
[ 3] 443/tcp                    ALLOW IN    Anywhere                   # accept HTTPS connections
[ 4] 1194/udp                   ALLOW IN    Anywhere                   # OpenVPN server
[ 5] 3000:4000/tcp              ALLOW IN    Anywhere                  
[ 6] 3000:4000/udp              ALLOW IN    Anywhere

To delete 6th rule type the command:
sudo ufw delete 6
sudo ufw status numbered

See how to delete a UFW firewall rule on Ubuntu / Debian Linux tutorial for further information.

Other command used to configure firewall with UFW

Let us learn a few more important commands.

Reset the ufw

sudo ufw reset

Reload the ufw

sudo ufw reload

View the firewall logs

By default all UFW entries are logged into /var/log/ufw.log file. Use the NA command/more command/tail command and other commands to view the ufw logs:
sudo more /var/log/ufw.log
sudo tail -f /var/log/ufw.log

Let us print a list of all IP address trying to log in via SSH port but dropped by the UFW:

grep 'DPT=22' /var/log/ufw.log |\
egrep -o 'SRC=([0-9]{1,3}[\.]){3}[0-9]{1,3}' |\
awk -F'=' '{ print $2 }' | sort -u

Show the list of rules

sudo ufw show listening
sudo ufw show added


Added user rules (see 'ufw status' for running firewall):
ufw allow from to port 22 proto tcp
ufw allow from to port 3128 proto tcp
ufw allow from to port 22 proto tcp

Setting up IP Masquerading with ufw

First edit the /etc/ufw/sysctl.conf and make sure you have the following line:
# IPv6

Next add top of the /etc/ufw/before.rules/file], before the *filter section for and wg0 interface:


Save and close the file. Finally, add the ufw route to allow the traffic:
sudo ufw route allow in on eth0 out on wg0 from
See “How to configure ufw to forward port 80/443 to internal server hosted on LAN” for more info.

Setting up egress filtering

Let us say you want to block RFC1918 addresses going out of eth0 interfaces on your VM connected to the Internet. Add the ufw route rules to reject the traffic:
$ sudo ufw route reject out on eth0 to comment 'RFC1918 reject'
$ sudo ufw route reject out on eth0 to comment 'RFC1918 reject'
$ sudo ufw route reject out on eth0 to comment 'RFC1918 reject'


In this quick tutorial, you learned how to secure your Ubuntu Linux 20.04 LTS server or desktop with the help of UFW. For more info, please see the ufw help page here.

🐧 Get the latest tutorials on Linux, Open Source & DevOps via RSS feed or Weekly email newsletter.

🐧 5 comments so far... add one

CategoryList of Unix and Linux commands
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network Utilitiesdig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
5 comments… add one
  • Tim O'Neil Nov 3, 2020 @ 8:48


    How can I enable ufw for lxd ? Any idea?

    • 🐧 Vivek Gite Nov 3, 2020 @ 8:49

      ufw is designed to run on VM or bare metal server. I never tried but will see if it works.

  • Harald Prasse Nov 22, 2020 @ 10:12

    I have look at almost every tutorial and proposed solution to have UFW running at system boot I could find. None has worked so far. Stating manually or with GUFW results in the status ‘active’. Alas after the next boot it is back to ‘inactive’. Do you have any idea where I might find a solution?
    running : Ubuntu 20.04.1 fully updated

    • 🐧 Vivek Gite Nov 22, 2020 @ 12:37

      Run the following commands. Is ufw enabled at boot time?
      sudo systemctl is-enabled ufw.service
      If not enable it:
      sudo systemctl enabled ufw.service
      sudo ufw enable

      Start the ufw:
      sudo systemctl start ufw.service
      Are you using any other firewall script or iptables based solution?

  • L Jan 16, 2021 @ 18:13

    Yes, I use iptables directly. Can you specify those commands instead of ufw?

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre> for code samples. Problem posting comment? Email me @