UFW Firewall Rules: Practical Examples

13 April 2026

Before ufw enable, allow SSH or you will lock yourself out.

Default policies

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable

SSH

sudo ufw allow 22/tcp                                          # from anywhere
sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp    # from one network
sudo ufw allow from 192.168.1.100 to any port 22 proto tcp     # from one IP
sudo ufw limit 22/tcp                                          # rate-limit brute force

Web

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Databases (only from inside)

sudo ufw allow from 192.168.1.0/24 to any port 3306 proto tcp    # MySQL/MariaDB
sudo ufw allow from 192.168.1.100 to any port 27017 proto tcp    # MongoDB

Other rules

sudo ufw deny from 192.168.1.100               # block an IP
sudo ufw deny 21/tcp                           # block a port
sudo ufw allow 10000:20000/tcp                 # port range
sudo ufw allow in on docker0 to any port 27017 # only on one interface
sudo ufw allow out 53                          # outbound DNS

Manage rules and logs

sudo ufw status numbered
sudo ufw delete 3
sudo ufw logging on
sudo tail -f /var/log/ufw.log

Docker warning: ports published with -p or ports: bypass UFW, because Docker writes its own iptables rules. Publish them only on 127.0.0.1 or filter them in the DOCKER-USER chain.