UFW manages firewall rules on a Linux VPS. This guide uses Debian or Ubuntu. If your VPS already uses firewalld or another firewall manager, use that tool rather than enabling UFW alongside it.
Before making changes
- Confirm that the VPS browser console works from your ArkHost Client Area.
- Keep your current SSH session open and test a new connection after each change.
- Identify the actual SSH port and the application ports you need.
- Record existing rules and back up the firewall configuration before changing a working setup.
The following check is read-only:
sudo ufw status verboseIf UFW is not installed and no other firewall manager is in use, install it:
sudo apt update
sudo apt install ufwAllow SSH before enabling UFW
For a fresh VPS using SSH on port 22, allow it first:
sudo ufw allow 22/tcpReplace 22 if your SSH server uses another port. If you already restrict SSH to a trusted address, preserve that restriction instead of adding a broader rule. Test a new SSH connection before continuing.
On a fresh setup, set the defaults and enable the firewall:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable
sudo ufw status verboseEnabling or reloading a firewall can affect connections. Open another SSH session after enabling it, and do not close your working session until the new one succeeds.
Allow application ports
Only open ports for services you intend to expose. For a public web server:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcpTo restrict a port to one trusted public address, use this pattern, replacing both placeholders:
sudo ufw allow from YOUR_TRUSTED_IP to any port YOUR_PORT proto tcpA new restricted rule does not cancel an existing broader allow rule. Review rule order and existing entries before assuming access is restricted.
Review or remove a rule
sudo ufw status numberedTo remove one rule, replace RULE_NUMBER with its current number:
sudo ufw delete RULE_NUMBERRule numbers change after deletion. List them again before deleting another entry. Never delete the rule that provides your only administrative connection.
IPv6 and containers
Check IPv6 as well as IPv4 if your VPS has both. An IPv4-only restriction does not prove the service is unreachable over IPv6.
Docker-published ports can bypass UFW's usual incoming rules. Do not assume an UFW deny rule protects a published container port. Review Docker's port bindings and firewall documentation, and test reachability from outside the VPS.
Troubleshooting safely
Use sudo ufw status verbose to review UFW-managed rules. For a preview of a specific command, put --dry-run after ufw. A preview is not a reachability test.
Do not run ufw reset as routine troubleshooting: it disables UFW and removes its rules. If access fails, use the browser console to correct the specific rule and retest SSH.
