How to Set Up UFW Firewall on Ubuntu 24.04 LTS (Complete Guide)

 Securing a cloud server or Linux machine begins with controlling network traffic. Every open port on an internet-facing system is a potential entry point for attackers conducting port scans, unauthorized access attempts, and automated exploits.

While advanced Linux utilities like nftables or iptables provide granular packet filtering, configuring them manually can be complex and error-prone. This is where UFW (Uncomplicated Firewall) comes in.

In this comprehensive guide, we will step through installing, configuring, and managing UFW on Ubuntu 24.04 LTS to build a robust defense layer for your server.

What is UFW and Why Should You Use It?

UFW, or Uncomplicated Firewall, is an administrative frontend for iptables designed to make firewall management straightforward for sysadmins and network engineers.

While it simplifies command syntax, UFW delivers high-grade security filtering without compromising performance or flexibility.

Key Benefits of UFW:

Ease of Use: Simple, intuitive syntax for defining access rules.

Default Security Stance: Easily enforce a strict "deny incoming / allow outgoing" traffic policy.

Application Profiles: Pre-configured rule templates for popular software like OpenSSH, Nginx, and Apache.

Integration: Works smoothly alongside dynamic security tools like Fail2ban.

Related Security Guides:

To automate protection against dynamic brute-force SSH attacks, check out our guide on How to Secure SSH with Fail2ban on Ubuntu 24.04 LTS.

For foundational system baseline hardening, explore our Linux Hardening Guide 2026.

Step 1: Install and Verify UFW

UFW comes pre-installed on most standard Ubuntu distributions, including Ubuntu 24.04 LTS. However, it is usually disabled by default.

First, update your package index to make sure your system is current:sudo apt update && sudo apt upgrade -y

If UFW is missing from your system, install it using apt:sudo apt install ufw -y

To check the current status of UFW:sudo ufw status

If UFW is inactive, the terminal will display Status: inactive.

Step 2: Configure Default UFW Policies

Before enabling the firewall, set up default behavior rules for incoming and outgoing connections. The standard best practice for server hardening is:

Deny all incoming traffic by default (blocks all unauthorized external connection requests).

Allow all outgoing traffic by default (allows your server to download package updates and make external API requests).

Run the following commands to apply these baseline rules:sudo ufw default deny incoming

sudo ufw default allow outgoing

Step 3: Allow Essential Services (SSH Access)

⚠️ CRITICAL WARNING: Before enabling UFW on a remote cloud server (e.g., AWS, DigitalOcean, Hetzner), you must allow SSH access. Enabling UFW without allowing SSH will lock you out of your server session immediately!

To permit incoming SSH connections on the default port 22:sudo ufw allow ssh

Or allow it directly by port number:sudo ufw allow 22/tcp

Custom SSH Port Configuration

If you modified your default SSH port as recommended in our detailed tutorial on Linux Server Hardening Best Practices, allow that custom port instead:sudo ufw allow 2222/tcp

Step 4: Allow Web Traffic and Custom Applications

If you are hosting a web application, server dashboard, or web service, enable standard HTTP and HTTPS ports:

Allow HTTP (Port 80):sudo ufw allow http

# OR

sudo ufw allow 80/tcp

Allow HTTPS (Port 443):sudo ufw allow https

# OR

sudo ufw allow 443/tcp

Using Application Profiles

UFW supports profile definitions for installed software. List available profiles using:sudo ufw app list

To enable full web access (HTTP + HTTPS) using Nginx profiles:sudo ufw allow 'Nginx Full'

Step 5: Enable and Test UFW

Once your essential rules (especially SSH) are in place, activate UFW:sudo ufw enable

You will see a prompt warning that the command may disrupt existing SSH connections. Type y and press Enter.

Verify that your rules are active and active numbered configurations:sudo ufw status verbose

To display rules with item numbers (useful for deleting specific rules later):sudo ufw status numbered

Step 6: Advanced Rules (IP Restrictions and Ranges)

Allow Connections From a Specific IP Address

To grant full access to a trusted static IP address (such as your home or office connection):sudo ufw allow from 203.0.113.50

Allow a Specific IP to Access a Specific Port

To allow a specific IP address to connect only to SSH:sudo ufw allow from 203.0.113.50 to any port 22 proto tcp

Block/Deny an IP Address

If you observe persistent suspicious traffic from an IP:sudo ufw deny from 198.51.100.25

Step 7: How to Delete UFW Rules

If you need to remove a rule, display the numbered rule list first:sudo ufw status numbered

Output example:[ 1] 22/tcp ALLOW IN Anywhere

[ 2] 80/tcp ALLOW IN Anywhere

To delete rule number 2 (HTTP access):sudo ufw delete 2

Conclusion

Setting up a firewall is one of the most effective ways to reduce your Linux server's attack surface. By implementing UFW on Ubuntu 24.04 LTS, you enforce strict boundary access control, ensure only legitimate services accept incoming network traffic, and maintain clear visibility over open communication ports.

Combine UFW rules with automated intrusion protection tools like Fail2ban and key-based authentication to maintain an optimal server security posture.

Have questions about setting up firewall profiles or custom ports? Drop your questions in the comments below!