50 Useful UFW Firewall Commands

Command of the Day

sudo ufw status verbose

What it does: Displays detailed information on current UFW state, default policies, logging levels, and active firewall rules.

The Uncomplicated Firewall (UFW) provides a clean and powerful interface for managing Linux packet filtering rules. While simple commands cover everyday web server setup, complex scenarios like subnet whitelisting, interface binding, rate limiting, and NAT routing require precise syntax.

Here is a definitive cheatsheet of 50 practical UFW commands for your RivinCloud VPS.

1. Status & Core Management

Check status with rule numbers:
```
sudo ufw status numbered
```
Check detailed verbose status:
```
sudo ufw status verbose
```
Enable firewall:
```
sudo ufw enable
```
Disable firewall:
```
sudo ufw disable
```
Reload rules without restarting:
```
sudo ufw reload
```
Reset all rules to factory defaults:
```
sudo ufw reset
```
Set default incoming policy to DENY:
```
sudo ufw default deny incoming
```
Set default outgoing policy to ALLOW:
```
sudo ufw default allow outgoing
```
Set default incoming policy to REJECT:
```
sudo ufw default reject incoming
```
Set default forward policy to DENY:
```
sudo ufw default deny forward
```

2. Basic Port & Protocol Rules

Allow SSH port (22):
```
sudo ufw allow 22/tcp
```
Allow HTTP port (80):
```
sudo ufw allow 80/tcp
```
Allow HTTPS port (443):
```
sudo ufw allow 443/tcp
```
Allow DNS port (53 UDP):
```
sudo ufw allow 53/udp
```
Allow Minecraft server port (25565):
```
sudo ufw allow 25565/tcp
```
Allow MySQL port (3306):
```
sudo ufw allow 3306/tcp
```
Allow PostgreSQL port (5432):
```
sudo ufw allow 5432/tcp
```
Allow Redis port (6379):
```
sudo ufw allow 6379/tcp
```
Allow continuous port range (TCP):
```
sudo ufw allow 8000:8080/tcp
```
Allow continuous port range (UDP):
```
sudo ufw allow 5000:5050/udp
```

3. Application Profiles

List all available application profiles:
```
sudo ufw app list
```
View details of an application profile:
```
sudo ufw app info "Nginx Full"
```
Allow Nginx HTTP and HTTPS simultaneously:
```
sudo ufw allow "Nginx Full"
```
Allow OpenSSH profile:
```
sudo ufw allow OpenSSH
```
Allow Apache Full profile:
```
sudo ufw allow "Apache Full"
```

4. IP Address & Subnet Rules

Allow all traffic from a specific IP:
```
sudo ufw allow from 203.0.113.10
```

Allow a specific IP access to SSH (port 22) only:

sudo ufw allow from 203.0.113.10 to any port 22 proto tcp

Allow a specific IP access to MySQL (port 3306):

sudo ufw allow from 203.0.113.10 to any port 3306 proto tcp

Allow an entire CIDR subnet (e.g., 192.168.1.0/24):
```
sudo ufw allow from 192.168.1.0/24
```

Allow subnet access to specific port:

sudo ufw allow from 10.0.0.0/8 to any port 8080 proto tcp

Block/Deny a specific attacker IP:
```
sudo ufw deny from 198.51.100.4
```
Block an entire malicious subnet:
```
sudo ufw deny from 198.51.100.0/24
```
Reject traffic from an IP (sends ICMP reject packet):
```
sudo ufw reject from 198.51.100.4
```

Deny incoming traffic from an IP on port 80:

sudo ufw deny from 198.51.100.4 to any port 80 proto tcp

5. Rate Limiting & Network Interfaces

Rate-limit SSH connections (blocks IPs with >6 connections in 30s):
```
sudo ufw limit 22/tcp
```
Rate-limit by application name:
```
sudo ufw limit ssh
```
Allow traffic on a specific network interface (e.g. eth0):
```
sudo ufw allow in on eth0 to any port 80 proto tcp
```
Allow traffic on internal VPN interface (e.g. wg0 or tun0):
```
sudo ufw allow in on wg0
```
Deny traffic on public interface while allowing internal:
```
sudo ufw deny in on eth0 to any port 3306 proto tcp
```

6. Rule Deletion & Reordering

Delete a rule by exact command syntax:
```
sudo ufw delete allow 80/tcp
```
Delete a rule by numbered index:
```
sudo ufw delete 3
```

Insert a rule at the top of the priority list (Rule #1):

sudo ufw insert 1 allow from 203.0.113.50 to any port 22 proto tcp

Insert a deny rule before allow rules:

sudo ufw insert 1 deny from 198.51.100.5

7. Logging & Diagnostic Commands

Enable standard firewall logging:
```
sudo ufw logging on
```
Disable logging:
```
sudo ufw logging off
```
Set logging level to medium:
```
sudo ufw logging medium
```
Set logging level to high (logs all packets):
```
sudo ufw logging high
```

View recent blocked connections in syslog:

sudo grep -i ufw /var/log/syslog | tail -n 20

View UFW dedicated log file (if configured):
```
sudo tail -f /var/log/ufw.log
```
Show raw iptables rules generated by UFW:
```
sudo ufw show raw
```

Common Mistakes

Forgetting rule order precedence: UFW evaluates rules in order from top to bottom. If a broad allow anywhere rule is at index 1, an IP block inserted at index 5 will never be evaluated! Use sudo ufw insert 1 deny ... to block first.
Deleting the wrong rule number: Numbers shift when rules are deleted. Always run sudo ufw status numbered before deleting.

Conclusion

This cheatsheet equips you with the complete command reference needed to secure any server scenario. Keep this reference handy for hardening your RivinCloud VPS!