Firewall & Security Basics (ufw)

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand Firewall & Security Basics (ufw) without any of the intimidation
Get comfortable trying these commands yourself in the terminal
See how these commands are actually useful on a real server/project

Let's think about it this way for a second

A firewall is a gatekeeper that decides, rule by rule, what network traffic to allow or block — on the Ubuntu/Debian family, ufw (Uncomplicated Firewall) is a tool that gives you a simple way to control the underlying firewall (iptables). A port is the 'door number' each service uses for communication — SSH (port 22), HTTP web traffic (port 80), HTTPS (port 443), and so on are standard ports agreed upon worldwide. You open ports one at a time with patterns like ufw allow ssh or ufw allow 80, and setting the default policy to 'deny incoming' is best practice — open the door only for the ports you need, and keep everything else closed.

Let's connect it to a real scenario

After setting up a web server, run sudo ufw allow OpenSSH first (open the SSH port first — otherwise you won't be able to connect to the server at all!), then sudo ufw allow 'Nginx Full' (the HTTP/HTTPS ports), and only then sudo ufw enable — the order matters, because if you enable the firewall before opening SSH, you can lock yourself out of your own server. Run sudo ufw status to see the list of open ports.

Firewall = a gatekeeper for network traffic, with rules set per port
Open SSH before enabling the firewall (otherwise you risk getting locked out)
ufw status = view the list of open ports

Let's try it together in the terminal

bash

sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable
sudo ufw status

You should see

Running sudo ufw status shows 'Status: active' along with a table of the open ports (22, 80, 443).

5-minute try-it

Try running sudo ufw status (on a system where it's installed). If the firewall is active, write down which ports are open.

One thing to watch out for

On a cloud server, double-check that the SSH port is allowed before you enable ufw — if you get locked out, you'll have to get back in through the provider's web console, which can be a real hassle.

Easy traps

Running ufw enable before opening the SSH port, and locking yourself out of the remote server
Assuming the server is safe just because the firewall is on, and neglecting software updates (apt upgrade) — a firewall is one layer, but security needs many layers

Now try it yourself

Try running sudo ufw status (on a system where it's installed). If the firewall is active, write down which ports are open.

You'll know it worked when: Running sudo ufw status shows 'Status: active' along with a table of the open ports (22, 80, 443).