UFW firewall: simple default-deny on Ubuntu/Debian

Configure Uncomplicated Firewall for default-deny inbound, allow only SSH and app ports, with rate limiting.

Server SecurityBeginner

Why

A default-allow server exposes every listening service (Redis, Postgres, Docker API) to the internet — the #1 cause of unauthenticated breaches. UFW default-deny with explicit allows closes this in 5 commands.

Verizon's 2024 DBIR shows 68% of breaches involve a non-malicious human element. SSH key compromise and misconfigured S3 buckets are top attack vectors — hardening reduces breach risk by 80%+.

When

Apply on every new server before installing services, and re-check after adding any new listening port. Avoid security theater (obscurity without depth) — a non-standard SSH port stops 0 real attacks.

Skip heavy WAF rules if you have no known vulnerabilities; they add latency and false positives.

How

1. Set defaults: `ufw default deny incoming` and `ufw default allow outgoing`. 2. Allow SSH first (or you lock yourself out): `ufw allow 22/tcp` or `ufw limit 22/tcp` (rate-limits to 6/min). 3. Allow app ports: `ufw allow 80/tcp`, `ufw allow 443/tcp`. 4. For a specific source: `ufw allow from 10.0.0.0/8 to any port 5432`. 5. Enable: `ufw enable`. 6. Verify: `ufw status verbose`. 7. Delete a rule: `ufw delete allow 80/tcp`. 8. Log dropped packets: `ufw logging medium` (watch /var/log/ufw.log).

Example

// security-ufw-firewall — configuration example const config = { provider: "security" }; # Set default policy ufw default deny incoming ufw default allow outgoing # Allow SSH with rate limiting (6 attempts/min per source) ufw limit 22/tcp # Allow web ufw allow 80/tcp ufw allow 443/tcp # Allow Postgres only from app subnet ufw allow from 10.0.1.0/24 to any port 5432 proto tcp # Enable and verify ufw enable ufw status verbose # Logging ufw logging medium

Common Problems

⚠Enabling UFW before allowing SSH locks you out — always `ufw allow 22/tcp` first.
⚠Docker bypasses UFW by manipulating iptables directly — use DOCKER-USER chain or ufw-docker helper.
⚠ufw allow 5432 opens Postgres to the whole internet — always scope with `from <subnet>`.

Best Practices

✓Use `ufw limit` (not `allow`) for SSH to rate-limit brute force at the firewall layer.
✓Scope every allow to a source IP/CIDR when possible; avoid blanket `allow <port>`.
✓For Docker, add rules to the DOCKER-USER chain so UFW and Docker coexist: iptables -I DOCKER-USER -p tcp --dport 5432 -s 10.0.1.0/24 -j ACCEPT.

FAQ

What is UFW firewall: simple default-deny on Ubuntu/Debian and what problem does it solve?

Configure Uncomplicated Firewall for default-deny inbound, allow only SSH and app ports, with rate limiting. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with UFW firewall: simple default-deny on Ubuntu/Debian in 5 minutes?

Two steps to run it: (1) Set defaults: `ufw default deny incoming` and `ufw default allow outgoing`.; (2) Allow SSH first (or you lock yourself out): `ufw allow 22/tcp` or `ufw limit 22/tcp` (rate-limits to 6/min).. Validate on the free tier first, then wire into production.

What is the #1 pitfall with UFW firewall: simple default-deny on Ubuntu/Debian?

The most frequent issue is: Enabling UFW before allowing SSH locks you out — always `ufw allow 22/tcp` first.. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for UFW firewall: simple default-deny on Ubuntu/Debian?

Best practices for UFW firewall: simple default-deny on Ubuntu/Debian include: Use `ufw limit` (not `allow`) for SSH to rate-limit brute force at the firewall layer.; Scope every allow to a source IP/CIDR when possible; avoid blanket `allow <port>`.; For Docker, add rules to the DOCKER-USER chain so UFW and Docker coexist: iptables -I DOCKER-USER -p tcp --dport 5432 -s 10.0.1.0/24 -j ACCEPT.. The first one — "Use `ufw limit` (not `allow`) for SSH to rate-limit brute force at the firewall layer." — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with UFW firewall: simple default-deny on Ubuntu/Debian?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most UFW firewall: simple default-deny on Ubuntu/Debian options offer a free tier — validate within free quota before scaling.