> ## Documentation Index
> Fetch the complete documentation index at: https://docs.digitalfyre.com/llms.txt
> Use this file to discover all available pages before exploring further.

# UFW Firewall Basics

UFW (Uncomplicated Firewall) is a user-friendly frontend for iptables, available by default on most Debian and Ubuntu systems. This guide covers installation, common rules, and DigitalFyre-specific considerations.

## Installation

<Tabs>
  <Tab title="Debian / Ubuntu">
    ```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
    apt update && apt install ufw -y
    ```
  </Tab>

  <Tab title="RHEL / AlmaLinux / Rocky">
    UFW is not included by default on RHEL-based distributions. These systems use `firewalld` instead, but UFW can be installed if preferred:

    ```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
    dnf install epel-release -y
    dnf install ufw -y
    ```
  </Tab>
</Tabs>

## Initial Setup

<Warning>
  Before enabling UFW, **always allow SSH first**. If you enable UFW without an SSH rule, you will lose access to your server and need to use the VirtFusion console (VPS) or IPMI (Bare Metal) to recover.
</Warning>

```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
# Allow SSH before anything else
ufw allow 22/tcp

# Set default policies
ufw default deny incoming
ufw default allow outgoing

# Enable the firewall
ufw enable
```

Confirm with `ufw status verbose` to verify your rules are active.

## Common Rules

### Allow by Port

```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
# Web traffic
ufw allow 80/tcp
ufw allow 443/tcp

# Custom SSH port
ufw allow 2222/tcp

# Allow a port range
ufw allow 6000:6010/tcp
```

### Allow by IP Address

```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
# Allow a specific IP to all ports
ufw allow from 203.0.113.50

# Allow a specific IP to a specific port
ufw allow from 203.0.113.50 to any port 22

# Allow a subnet
ufw allow from 10.0.0.0/8
```

### Deny and Rate Limiting

```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
# Deny a specific IP
ufw deny from 198.51.100.0/24

# Rate limit SSH (blocks IPs with 6+ connection attempts in 30 seconds)
ufw limit 22/tcp
```

### Deleting Rules

```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
# List rules with numbers
ufw status numbered

# Delete by number
ufw delete 3

# Delete by rule definition
ufw delete allow 80/tcp
```

## DigitalFyre-Specific Considerations

### VPS (VirtFusion)

DigitalFyre VPS servers use **cloud-init** for initial provisioning and **qemu-guest-agent** for host communication. These services operate at the hypervisor level and are not affected by UFW rules inside your VPS. You are free to configure your firewall however you need.

### Managed Services

If you have a managed service with DigitalFyre, you will need to allow access for DigitalFyre's management infrastructure:

* **Jump Server IPs** — Required for support team SSH access. Request these IPs from [support](https://console.digitalfyre.com/submitticket.php).
* **Monitoring Probe IPs** — Required for proactive server monitoring. Request these IPs from [support](https://console.digitalfyre.com/submitticket.php).

```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
# Example: allow DigitalFyre jump server
ufw allow from <JUMP_SERVER_IP> to any port 22

# Example: allow DigitalFyre monitoring probe
ufw allow from <MONITORING_PROBE_IP>
```

### Uptime Monitoring

DigitalFyre uses [UptimeRobot](https://uptimerobot.com/) for uptime monitoring. If you restrict ICMP or HTTP/HTTPS traffic, you may need to allowlist UptimeRobot's probe IPs to avoid false downtime alerts.

UptimeRobot publishes its probe IP list at: [uptimerobot.com/inc/files/ips/IPv4andIPv6.txt](https://uptimerobot.com/inc/files/ips/IPv4andIPv6.txt)

At minimum, allow **ICMP** (ping) and **HTTP/HTTPS** (ports 80 and 443) from these addresses.

## Useful Commands

| Command               | Description                                       |
| --------------------- | ------------------------------------------------- |
| `ufw status`          | Show current rules and status                     |
| `ufw status verbose`  | Show rules with default policies                  |
| `ufw status numbered` | Show rules with line numbers (for deletion)       |
| `ufw reload`          | Reload rules without disabling                    |
| `ufw disable`         | Disable the firewall (all rules inactive)         |
| `ufw reset`           | Reset to defaults and disable (removes all rules) |
| `ufw app list`        | Show available application profiles               |

## Recovery

If you lock yourself out:

1. **VPS** — Log in through the VirtFusion console (accessible from the customer portal) and run `ufw disable` or `ufw allow 22/tcp`
2. **Bare Metal** — Access the server through IPMI/KVM and correct the rules
3. If you cannot access the console, contact [support](https://console.digitalfyre.com/submitticket.php) for assistance