Home › Guides › Linux
Linux · How-to

How to Set Up a Default-Deny Firewall with UFW

Close every inbound port except the ones you actually use — the highest-value five-minute hardening step.

You'll need: Ubuntu with UFW available (installed by default on most).

Steps

  1. Set the default inbound policy to deny: sudo ufw default deny incoming.
  2. Allow outgoing traffic: sudo ufw default allow outgoing.
  3. If you use SSH, allow it BEFORE enabling or you'll disconnect: sudo ufw allow OpenSSH.
  4. Enable the firewall: sudo ufw enable.
  5. Check the ruleset: sudo ufw status verbose.
Watch outEnable SSH access before turning the firewall on. On a remote box, a default-deny firewall with no SSH rule locks you out instantly.

Go deeper: Build a Hardened Linux Workstation

The Linux guide has the full ruleset, how to open specific ports, and app profiles.

Get the guide