SSH
Leave empty to allow SSH from anywhere.
Public services
A port without /udp is opened for TCP only.
Private services
Databases and caches should never be open to the internet. Allow them only from the servers that need them.
Your commands
How to use the UFW rule builder
- Enter your SSH port and, if you have a fixed IP address, restrict SSH to it. Otherwise keep the rate limit on.
- Tick the services that should be reachable from the internet, and any database that another server needs, with that server’s IP.
- Run the commands on the server, in order. They set the defaults, allow SSH before anything else, then enable the firewall and show the result.
The commands are built in your browser. Nothing you enter is sent to Cloudhim.
Why the order matters
Enabling UFW applies its rules immediately, including to the SSH session you’re using. If SSH isn’t allowed at that moment, the connection drops and you’re locked out. That’s why SSH is always allowed first and ufw enable comes last. If it happens anyway, your provider’s web console still works; our guide to getting back into a VPS after a UFW lockout shows how.
Docker and UFW
Docker adds its own iptables rules ahead of UFW’s, so a container port published as 8080:80 is reachable from the internet even if UFW doesn’t allow 8080. Publish container ports on 127.0.0.1 and put a reverse proxy in front, as explained in Docker bypasses UFW.
Checking the result
sudo ufw status numbered lists the rules with numbers, and sudo ufw delete 3 removes rule 3. From another machine, the Open Port Checker shows which ports are actually reachable. Remember that your cloud provider may have its own firewall (Hetzner, DigitalOcean, AWS security groups) in front of the server; both have to allow a port.