UFW Firewall Basics - DigitalFyre Knowledge Base

UFW (Uncomplicated Firewall) is a user-friendly frontend for iptables, available by default on most Debian and Ubuntu systems. This guide covers installation, common rules, and DigitalFyre-specific considerations.

Installation

Debian / Ubuntu
RHEL / AlmaLinux / Rocky

apt update && apt install ufw -y

UFW is not included by default on RHEL-based distributions. These systems use firewalld instead, but UFW can be installed if preferred:

dnf install epel-release -y
dnf install ufw -y

Initial Setup

Before enabling UFW, always allow SSH first. If you enable UFW without an SSH rule, you will lose access to your server and need to use the VirtFusion console (VPS) or IPMI (Bare Metal) to recover.

# Allow SSH before anything else
ufw allow 22/tcp

# Set default policies
ufw default deny incoming
ufw default allow outgoing

# Enable the firewall
ufw enable

Confirm with ufw status verbose to verify your rules are active.

Common Rules

Allow by Port

# Web traffic
ufw allow 80/tcp
ufw allow 443/tcp

# Custom SSH port
ufw allow 2222/tcp

# Allow a port range
ufw allow 6000:6010/tcp

Allow by IP Address

# Allow a specific IP to all ports
ufw allow from 203.0.113.50

# Allow a specific IP to a specific port
ufw allow from 203.0.113.50 to any port 22

# Allow a subnet
ufw allow from 10.0.0.0/8

Deny and Rate Limiting

# Deny a specific IP
ufw deny from 198.51.100.0/24

# Rate limit SSH (blocks IPs with 6+ connection attempts in 30 seconds)
ufw limit 22/tcp

Deleting Rules

# List rules with numbers
ufw status numbered

# Delete by number
ufw delete 3

# Delete by rule definition
ufw delete allow 80/tcp

DigitalFyre-Specific Considerations

VPS (VirtFusion)

DigitalFyre VPS servers use cloud-init for initial provisioning and qemu-guest-agent for host communication. These services operate at the hypervisor level and are not affected by UFW rules inside your VPS. You are free to configure your firewall however you need.

Managed Services

If you have a managed service with DigitalFyre, you will need to allow access for DigitalFyre’s management infrastructure:

Jump Server IPs — Required for support team SSH access. Request these IPs from support.
Monitoring Probe IPs — Required for proactive server monitoring. Request these IPs from support.

# Example: allow DigitalFyre jump server
ufw allow from <JUMP_SERVER_IP> to any port 22

# Example: allow DigitalFyre monitoring probe
ufw allow from <MONITORING_PROBE_IP>

Uptime Monitoring

DigitalFyre uses UptimeRobot for uptime monitoring. If you restrict ICMP or HTTP/HTTPS traffic, you may need to allowlist UptimeRobot’s probe IPs to avoid false downtime alerts. UptimeRobot publishes its probe IP list at: uptimerobot.com/inc/files/ips/IPv4andIPv6.txt At minimum, allow ICMP (ping) and HTTP/HTTPS (ports 80 and 443) from these addresses.

Useful Commands

Command	Description
`ufw status`	Show current rules and status
`ufw status verbose`	Show rules with default policies
`ufw status numbered`	Show rules with line numbers (for deletion)
`ufw reload`	Reload rules without disabling
`ufw disable`	Disable the firewall (all rules inactive)
`ufw reset`	Reset to defaults and disable (removes all rules)
`ufw app list`	Show available application profiles

Recovery

If you lock yourself out:

VPS — Log in through the VirtFusion console (accessible from the customer portal) and run ufw disable or ufw allow 22/tcp
Bare Metal — Access the server through IPMI/KVM and correct the rules
If you cannot access the console, contact support for assistance

​Installation

​Initial Setup

​Common Rules

​Allow by Port

​Allow by IP Address

​Deny and Rate Limiting

​Deleting Rules

​DigitalFyre-Specific Considerations

​VPS (VirtFusion)

​Managed Services

​Uptime Monitoring

​Useful Commands

​Recovery

Installation

Initial Setup

Common Rules

Allow by Port

Allow by IP Address

Deny and Rate Limiting

Deleting Rules

DigitalFyre-Specific Considerations

VPS (VirtFusion)

Managed Services

Uptime Monitoring

Useful Commands

Recovery