The Linux Firewall Command That Blocks Everything Except What You Explicitly Allow

Most firewalls are configured wrong by default. Here is how to set one up the right way in under five minutes

Photo by Declan Sun on Unsplash

A firewall that allows everything by default and blocks specific things is a firewall you’ll eventually forget to update.

One new service starts. One port opens. Nobody notices. Months later something is exposed that shouldn’t be.

The correct approach is the opposite. Block everything by default. Then explicitly open only what you need. Anything you haven’t thought about stays closed automatically.

Linux has a tool that makes this straightforward. It’s called ufw, which stands for Uncomplicated Firewall. The name is accurate.

Check if ufw is installed

On Ubuntu it comes pre-installed. Check its current status:

sudo ufw status

If the output says inactive, ufw is installed but not running. If it says Status: active, it's already running with whatever rules are currently configured.

If ufw isn’t installed:

sudo apt install ufw

The single most important command: set the default to deny

Before enabling ufw, set the default policy. This is the rule that applies to everything that doesn’t match a specific rule you’ve written.

sudo ufw default deny incoming
sudo ufw default allow outgoing

The first line blocks all incoming traffic by default. Nothing gets in unless you explicitly allow it.

The second line allows all outgoing traffic by default. Your machine can initiate connections freely. Only unsolicited incoming traffic is blocked.

Run these two commands before enabling ufw and before adding any specific rules.

Allow SSH before enabling the firewall

This step is critical, especially on a remote server.

If you enable the firewall with a default deny policy and haven’t allowed SSH, you lock yourself out immediately. The firewall blocks port 22, your SSH connection drops, and you have no way back in without physical access to the machine.

Allow SSH first:

sudo ufw allow ssh

This is equivalent to:

sudo ufw allow 22/tcp

Both do the same thing. The first form is more readable. The second is explicit about the port and protocol.

Now enable the firewall

sudo ufw enable

You’ll see a warning that enabling ufw may disrupt existing connections. If you’ve already allowed SSH, confirm with y.

Check that it’s running:

sudo ufw status verbose

The output shows the default policies and every rule currently active.

Allow specific ports and services

Every rule you add explicitly opens a door. Everything else stays closed.

Allow HTTP web traffic:

sudo ufw allow 80/tcp

Allow HTTPS:

sudo ufw allow 443/tcp

Allow a custom application port:

sudo ufw allow 3000/tcp

Allow a specific service by name. ufw maintains a list of named services it recognises:

sudo ufw allow nginx

To see every named service ufw knows about:

sudo ufw app list

Allow traffic from a specific IP address only

Sometimes you want a port open but only to one trusted IP, not the whole internet.

sudo ufw allow from 192.168.1.100

This allows all traffic from that specific IP address.

To allow a specific IP to access only one port:

sudo ufw allow from 192.168.1.100 to any port 22

This opens SSH only for that IP. Every other IP trying to connect to port 22 gets blocked by the default deny policy.

Deny a specific IP address

If you want to explicitly block a known bad IP:

sudo ufw deny from 203.0.113.0

All traffic from that address drops immediately.

Check every rule currently active

sudo ufw status numbered

The numbered option shows rules with a number next to each one. That number matters when you want to delete a rule.

Delete a rule

Find the rule’s number with sudo ufw status numbered, then delete it by number:

sudo ufw delete 3

This removes rule number 3 from the list. Remaining rules shift their numbers down.

To delete a rule by its specification instead of its number:

sudo ufw delete allow 80/tcp

Disable the firewall temporarily

If you need to test something without the firewall interfering:

sudo ufw disable

This turns off all firewall rules. Re-enable when done:

sudo ufw enable

Disabling doesn’t delete your rules. They come back when you re-enable.

Reset everything and start fresh

If your rules are in a messy state and you want to begin from scratch:

sudo ufw reset

This disables the firewall, deletes all rules, and resets the defaults. You start from zero. Remember to set defaults and allow SSH again before re-enabling.

What a correct minimal server setup looks like

For a server running a web application, a clean minimal ufw setup looks like this:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Six commands. SSH is open. HTTP and HTTPS are open. Everything else is blocked. If you add a new service later and forget to open its port, the firewall blocks it automatically.

You have to make a conscious decision to open each port, which means nothing gets exposed accidentally.

That is the whole point of default deny. Not manually blocking bad things. Making sure only the things you’ve thought about are reachable.

Most people learn Linux commands. Few learn how to think. Every Wednesday in Terminal to AI I share one practical terminal skill and one sharp lesson about information, decisions, and building a life that actually pays. Former smart contract auditor. Learning in public. Free to join. **Terminal to AI →**