Knowledge centre

Open only the paths you need

A firewall workflow that starts by preserving access to the server.

2 min readEnglish

Content revised 10 October 2026 · English

At a glance

Guide type: Operate & secure
Examples: Illustrative, environment-specific
Integration scope: No remote machine connected

List the services before opening ports

Record the administration port, web listener, database location and any product-specific UDP/TCP requirements. A database used only on the same machine should not need a public rule. Account for both guest rules and a live operator’s upstream firewall.

Permit the current administration route first

Keep a working session and a verified recovery console. Before enabling a restrictive firewall, allow the actual SSH port and required source range. The example below assumes SSH is currently on port 22; change it to match the running service.

UFW defaults and current SSH ruleReview for your environment

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp

Open application paths only when required

For a public web server, permit TCP 80 and 443. This does not enable the web service itself, and UDP/game/mail ports need their own explicit choices. Avoid a wide port range as a shortcut for diagnosing one application.

Public web exampleReview for your environment

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

Test a fresh connection and inspect IPv6

Open another administration connection and test the application externally. Read the effective UFW rules and the distribution’s IPv6 setting. An IPv4-only rule or upstream filter should not be assumed to protect an IPv6 listener.

Edit the identified rule, then test again

Numbered output helps locate an obsolete rule. Numbers change after deletions, so list them again before another change. On systems using firewalld or nftables, follow that tool’s native configuration rather than combining competing managers.

Inspect before changing a ruleReview for your environment

sudo ufw status numbered
# Remove only a rule you have identified, then list again:
# sudo ufw delete <rule-number>

BEFORE THE NEXT STEP

Leave with a verifiable result.

List the services before opening ports.
Edit the identified rule, then test again.
Keep recovery information and secrets outside public files.

GO TO THE PRIMARY SOURCEUbuntu · firewall administration