A firewall is the fastest way to shrink your server's attack surface — block everything, then allow only what you use. On Ubuntu/Debian, UFW (Uncomplicated Firewall) makes it genuinely simple. Here is how to set it up safely.
Quick answer
To set up UFW safely, allow SSH first (ufw allow OpenSSH or your SSH port), then set ufw default deny incoming and ufw default allow outgoing, allow the ports you use — web, game ports — and run ufw enable. Check the rules with ufw status verbose.
Always allow your SSH port BEFORE you enable the firewall. If you enable a default-deny firewall without allowing SSH, you will be locked out of your own server.
Step 1: set safe defaults
The right baseline is deny all incoming, allow all outgoing — that blocks the world from reaching your server while letting your server reach out (for updates etc.):
sudo ufw default deny incoming
sudo ufw default allow outgoingStep 2: allow SSH first (critical)
Before enabling anything, open your SSH port so you keep access:
sudo ufw allow 22/tcp
# if you moved SSH to a custom port
sudo ufw allow 2222/tcpStep 3: allow the ports your services need
Open only what you actually run. A few common examples:
# web server
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
# Minecraft
sudo ufw allow 25565/tcp
# a game server UDP example
sudo ufw allow 27015/udpStep 4: enable and check
sudo ufw enable
sudo ufw status verboseThe status output lists every rule. If a service is unreachable after this, you almost certainly have not opened its port — see finding your server IP and port.
Useful UFW commands
sudo ufw status numbered— list rules with numbers.sudo ufw delete 3— remove rule number 3.sudo ufw allow from 1.2.3.4 to any port 22— allow SSH only from your IP.sudo ufw disable— turn the firewall off.
A firewall is not optional on a public server. Default-deny plus a short allow-list stops the constant background scanning cold.
A firewall is one layer — pair it with hardened SSH and fail2ban for a properly locked-down VPS. See the full VPS hardening checklist.
Game servers: don't forget UDP
A common mistake is opening only the TCP port and finding the game still unreachable. Many game servers use UDP for gameplay and a separate query port for the server browser — you must allow the correct protocol and every port the game uses. Cross-check the exact ports with port forwarding a game server.
Restrict SSH to your own IP for extra safety
If your connection uses a static IP, the strongest move is to allow SSH only from that address rather than the whole internet, using ufw allow from your-ip to any port 22. That makes brute-force from unknown IPs impossible at the firewall level — just be sure your IP really is static, or keep console access ready.
How to avoid common UFW mistakes
- Always allow SSH before enabling the firewall.
- Open UDP as well as TCP for game servers, and include query ports.
- Keep the allow-list short — every open port is attack surface.
- Keep your host's console recovery handy in case a rule locks you out.
Related guides
Pair UFW with hardened SSH and fail2ban, and follow the whole VPS hardening checklist. If you're not sure which ports a service uses, start with finding your server IP and port.