How to Set Up a Firewall on Your Ubuntu VPS with UFW

Securing your Cubes Hosting Ubuntu VPS with a firewall is essential for protecting your server from port scans, brute-force SSH attacks, and unauthorized access to background services.

UFW (Uncomplicated Firewall) is the default firewall configuration interface for Ubuntu. It provides a simple, human-readable command-line interface over iptables rules.

This guide covers installing UFW, setting default security policies, allowing common game and web ports, and managing firewall rules safely.

⚠️ CRITICAL STEP: Always Allow SSH Before Enabling UFW!

WARNING: Enabling UFW without first allowing your SSH port will instantly lock you out of your VPS! Always execute Step 3 (Allowing SSH) before running sudo ufw enable.

Step 1: Check UFW Status & Install

Connect to your VPS via SSH as root or a user with sudo privileges.
Check if UFW is installed and active:
```
sudo ufw status
```
(By default on new Ubuntu installations, status will report Status: inactive).

If UFW is not installed, install it via apt:

sudo apt update && sudo apt install ufw -y

Step 2: Set Default Firewall Policies

A secure firewall configuration follows a Default Deny rule: block all incoming connections by default, while allowing all outgoing traffic from your server.

Run these commands to set the default policies:

# Block all uninvited incoming connections
sudo ufw default deny incoming

# Allow all outgoing connections initiated by your VPS
sudo ufw default allow outgoing

Step 3: Allow SSH Connection (Port 22)

Before turning on the firewall, authorize SSH connections so your current terminal session remains connected:

# Allow standard SSH port 22
sudo ufw allow 22/tcp

# OR allow by service name
sudo ufw allow ssh

(If you changed your SSH port to a custom port like 2222, run sudo ufw allow 2222/tcp instead).

Step 4: Allow Ports for Your Hosted Services

Depending on what applications or game servers you run on your VPS, open the required ports:

Web Hosting (HTTP & HTTPS)

sudo ufw allow 80/tcp    # HTTP
sudo ufw allow 443/tcp   # HTTPS (SSL)

Minecraft Server

sudo ufw allow 25565/tcp  # Java Edition
sudo ufw allow 19132/udp  # Bedrock Edition

BeamMP Server

sudo ufw allow 30814/tcp
sudo ufw allow 30814/udp

FiveM Server & txAdmin

sudo ufw allow 30120/tcp  # Game port
sudo ufw allow 30120/udp  # Game port
sudo ufw allow 40120/tcp  # txAdmin Web Panel

Terraria & Unturned

sudo ufw allow 7777/tcp   # Terraria
sudo ufw allow 27015/udp  # Unturned / Steam Query

Step 5: Enable UFW Firewall

Once you have added SSH and your required service ports, enable UFW:

sudo ufw enable

(Press y and Enter when prompted: Command may disrupt existing ssh connections. Proceed with operation?).

To verify your active rules, run:

sudo ufw status verbose

Step 6: Advanced Rules (IP Whitelisting & Deleting Rules)

Restrict SSH Access to Your Home IP Address:

For maximum security, restrict SSH Port 22 so that only your home or office IP address can attempt SSH logins:

sudo ufw allow from 203.0.113.50 to any port 22 proto tcp

(Replace 203.0.113.50 with your actual public IP address).

How to Delete a Firewall Rule:

List all rules with their line numbers:
```
sudo ufw status numbered
```
Delete a rule by its number:
```
sudo ufw delete 2
```

Disabling or Resetting UFW:

Temporarily Turn Off UFW: sudo ufw disable
Reset All Rules to Default: sudo ufw reset

Configuring UFW on your Cubes Hosting Ubuntu VPS takes less than two minutes and provides a strong defense against automated attacks. Always remember to allow SSH Port 22 first, open only the ports your services require, and keep your VPS secure!