What to know
- Inventory services and identify the existing firewall manager.
- Permit the real SSH port and intended administrator path first.
- Test fresh access and inspect Docker and cloud rules separately.
Use one firewall management system
This practical guide targets Ubuntu hosts managed with UFW. First identify any existing control-panel firewall, provider security group or Docker networking. Do not install a second policy manager over CSF, firewalld or a managed panel without a migration plan. Our recommended preparation is a service inventory containing protocol, listening address, port and intended clients, plus a working provider console.
Inspect the current state
The Ubuntu firewall guide describes UFW as a host firewall interface. Read its current configuration and compare it with listening sockets:
sudo ufw status verbose
sudo ss -lntupA listener on 127.0.0.1 has a different exposure from one on every interface. Check IPv6 as well as IPv4. Record the SSH port actually in use; a generic OpenSSH application profile may still describe port 22.
Add the access you need first
For this example only, 203.0.113.10 represents your fixed administrator address and 2222 represents your actual SSH port. Replace both before use. These commands add rules; review them in the UFW manual and adapt them to your own services.
sudo ufw allow proto tcp from 203.0.113.10 to any port 2222
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw show addedOnly open 80 and 443 when the host serves those web services. If administrators use changing mobile addresses, agree on an appropriate access method before restricting SSH to a single address.
Enable and verify in separate steps
Save the previous configuration, keep the original session open, then enable UFW only after the management rule is correct. Establish a fresh SSH session and test the website externally. Check provider rules separately: both layers must permit legitimate traffic. Docker’s firewall documentation explains why published container ports need special attention rather than an assumption that UFW covers every path.
Recovery and completion
If new access fails, use the retained session or provider console to restore the saved policy. Do not close the last working connection while troubleshooting. Record which ports are public and the result of an external check. Use the SSH key guide for authentication changes and the container networking guide for published ports.
Sources & further reading
Primary sources supporting this article. The practical recommendations are Kiava’s general guidance and should be adapted to your project.