Set Up a Firewall rule with UFW

What is a Firewall?

A firewall is a filter between your computer and network. It decides which connections get in and which not.

UFW (Uncomplicated Firewall) is the simplest firewall you can use.

Install UFW

UFW is Linux-only. If you're on macOS, you already have a firewall built in — we'll cover both.

Linux (Debian/Ubuntu):

UFW is usually pre-installed. Check with:

sudo ufw status

If it says "command not found":

sudo apt install ufw

macOS:

macOS uses a different firewall called pf (Packet Filter). It's already built in — no install needed. Check if it's running:

sudo pfctl -s info

macOS also has an application firewall in System Settings → Network → Firewall. It's less flexible than UFW but protects you automatically. For learning firewall concepts, UFW on Linux is the best tool. The rules and logic are identical across all firewalls — only the commands differ.

Windows: UFW is Linux/macOS only. Windows has its own firewall accessible through wf.msc (Windows Firewall with Advanced Security) or via PowerShell with New-NetFirewallRule. This article focuses on UFW, but the concepts are identical.

Check Your Firewall Status

sudo ufw status

If it's your first time, you'll likely see:

Status: inactive

Your firewall is off. Every port you saw in the nmap scan is open for business. Let's fix that.

Enable the Firewall

sudo ufw enable

Output:

Firewall is active and enabled on system startup

UFW's default policy is:

• Block all incoming connections
• Allow all outgoing connections

This means nobody can connect to your machine, but you can still browse the web, check email, and use apps normally. Outgoing traffic is fine — incoming is blocked unless you explicitly allow it.

Allow a Port

Now let's say you're running a web server on port 80 and want people to reach it.

sudo ufw allow 80

What this does: Opens port 80 for incoming TCP and UDP connections. Now check the status:

sudo ufw status

Output:

Status: active
To                         Action      From

80                         ALLOW       Anywhere

Port 80 is now open. Anyone can connect.

Block a Port

Changed your mind? Close it:

sudo ufw deny 80

Or remove the rule entirely:

sudo ufw delete allow 80

Allow a Specific IP Address

Maybe you only want your home computer to reach your server. Allow only that IP:

sudo ufw allow from 192.168.1.50 to port 22

What this does: Only the machine at 192.168.1.50 can connect to port 22 (SSH). Everyone else is blocked. This is how you harden a server — SSH is open, but only for you.

Allow by Service Name

UFW knows common services by name:

sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https

This is equivalent to allowing ports 22, 80, and 443.

Enable Logging

Want to see what your firewall is blocking? Turn on logs:

sudo ufw logging on

Logs go to /var/log/ufw.log on Linux. Check them:

sudo tail -f /var/log/ufw.log

Now you can watch blocked connections in real time — just like in the logs article. Every blocked attempt is a potential attack that your firewall stopped.

Connect It Back: Test with Nmap

Run a scan before and after enabling UFW:

nmap localhost

With UFW disabled, you'll see open ports. With UFW enabled (and only port 80 allowed), you'll see only port 80 open — everything else is filtered.