🧠 Introduction

When you rent a VPS or install Linux on a server, your system is exposed to the internet—and trust me, hackers scan new servers within minutes.
But don’t panic! Securing your Linux server is not rocket science. One of the simplest and safest ways to protect your machine is by using UFW (Uncomplicated Firewall).

UFW is exactly what its name says: a firewall that is not complicated.
You don’t need to understand deep networking or cryptic commands.

In this tutorial, I’ll guide you step-by-step, like an older friend walking you through your first server setup. Even if you’re a total beginner, you will understand exactly what to do and why.

Let's begin securing your server.

---

🏁 Step 1 — Check if UFW Is Installed

Most Ubuntu/Debian systems already include UFW.

Run:

sudo ufw status

If the output is something like:

Status: inactive

then UFW is installed but not active (which is normal).

If you see an error "command not found", install UFW:

sudo apt install ufw -y

---

🔌 Step 2 — Allow SSH Before Enabling the Firewall

This is VERY important.

If you enable a firewall without allowing SSH first,
you will lock yourself out of your own server.

So before enabling UFW, run:

sudo ufw allow ssh

This opens port 22, which your SSH connection uses.

To verify:

sudo ufw status

---

🚀 Step 3 — Enable UFW

Once SSH is allowed, you can safely activate UFW:

sudo ufw enable

It will ask:

Command may disrupt existing SSH connections. Proceed with operation (y|n)?

Press y.

To confirm:

sudo ufw status verbose

Your firewall is now active and protecting your server.

---

🌐 Step 4 — Allow Common Services

Here are typical ports you may need:

✔ Allow HTTP (port 80)

sudo ufw allow 80/tcp

✔ Allow HTTPS (port 443)

sudo ufw allow 443/tcp

✔ Allow MySQL (3306) — (Only if needed!)

sudo ufw allow 3306/tcp

✔ Allow custom port

Example port 8080:

sudo ufw allow 8080

✔ Allow specific IP only

Only 1 trusted IP can access port 22 (SSH):

sudo ufw allow from 123.456.789.123 to any port 22

This increases security dramatically.

---

🔐 Step 5 — Deny or Remove Rules

❌ Deny a port:

sudo ufw deny 3306

❌ Delete a rule:

sudo ufw delete allow 8080

❌ Reset the firewall:

⚠ Use with caution

sudo ufw reset

---

🚫 Step 6 — Block IP Addresses

Sometimes bots or attackers spam your server.
You can block them:

Block an IP:

sudo ufw deny from 192.168.1.99

Block a range:

sudo ufw deny from 192.168.0.0/16

View rules:

sudo ufw status numbered

---

🔧 Step 7 — Enable Logging

Logging helps you monitor attacks or blocked attempts.

Enable:

sudo ufw logging on

Disable:

sudo ufw logging off

---

📜 Step 8 — Check UFW Rules

View all rules:

sudo ufw status numbered

For detailed information:

sudo ufw show raw

---

🛡 Step 9 — Disable UFW (If Needed)

If something breaks and you need to turn firewall off temporarily:

sudo ufw disable

This stops enforcing all rules.

---

🎯 Best Practices for Beginners

Here are simple rules to keep your Linux server safe without overthinking:

✔ Always allow SSH before enabling UFW

✔ Open only the ports you need

✔ Close ports after finishing testing

✔ Regularly check logs for weird activity

✔ Restrict SSH to one IP if possible

✔ Use strong passwords or SSH keys

These small tips prevent 99% of attacks.

---

🎉 Conclusion

You’ve just completed a core skill every server admin must know: setting up a Linux firewall.
Thanks to UFW’s simple design, you now understand:

• How to enable/disable a firewall

• How to allow or block ports

• How to block IP addresses

• How to secure SSH

• How to maintain good server security practices

With this knowledge, your server is already significantly more secure than most beginner setups.