VPS Firewall with UFW & iptables: Protect Against Unauthorized Access

June 2026 · 6 min read

A firewall is the first line of defense that filters network traffic before it reaches applications on your VPS. Without a firewall, every port running a service is accessible from anywhere on the internet.

UFW: Simple Firewall for Beginners

UFW (Uncomplicated Firewall) is a user-friendly frontend for iptables, perfect for typical VPS deployments.

apt install ufw

# Set default policies
ufw default deny incoming
ufw default allow outgoing

# Open required ports
ufw allow 22/tcp     # SSH (or your custom port)
ufw allow 80/tcp     # HTTP
ufw allow 443/tcp    # HTTPS

# Enable firewall
ufw enable
ufw status verbose

Open Ports Only from Trusted IPs

# Open MySQL only from specific IP
ufw allow from 1.2.3.4 to any port 3306

# Open SSH only from office or home IP range
ufw allow from 203.0.113.0/24 to any port 22

Delete Rules

ufw status numbered    # View rule numbers
ufw delete 3           # Delete rule number 3

iptables: Advanced Control

iptables is a kernel-level firewall that UFW uses behind the scenes. It's ideal for complex rule requirements.

# View current rules
iptables -L -n -v --line-numbers

# Allow ports
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Block suspicious IP addresses
iptables -A INPUT -s 1.2.3.4 -j DROP

# Drop all incoming traffic not explicitly allowed
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT

Make iptables rules persistent across reboots:

apt install iptables-persistent
netfilter-persistent save

Rate Limiting: Prevent Brute Force Attacks

Limit new connections per minute from each IP to prevent brute force attacks:

ufw limit ssh/tcp
# Or with iptables
iptables -A INPUT -p tcp --dport 22 -m state --state NEW \
  -m recent --update --seconds 60 --hitcount 4 -j DROP
iptables -A INPUT -p tcp --dport 22 -m state --state NEW \
  -m recent --set -j ACCEPT

Docker and UFW Conflicts

Docker adds iptables rules directly, bypassing UFW. If you publish a port with -p 3306:3306, it opens to the internet even if UFW blocks it.

Solution: Bind only to localhost -p 127.0.0.1:3306:3306 or use Docker networks instead.

Verify Firewall is Working Correctly

# View all active rules
ufw status numbered
ufw status verbose

# Check open ports from outside
nmap -p 22,80,443 YOUR_VPS_IP

# View all listening ports on your VPS
ss -tlnp

Common Issues & Troubleshooting

Error: SSH Access Denied After Enabling UFW

This happens when you enable UFW before allowing SSH, or you allow the wrong port:

# If you still have console access (KVM/VNC)
ufw disable   # Temporarily disable UFW
ufw allow YOUR_SSH_PORT/tcp
ufw enable

# Check which SSH port is actually in use
grep Port /etc/ssh/sshd_config

Docker Container Accessible from Outside Despite UFW Block

Docker bypasses UFW by injecting iptables rules directly. The easiest solution:

# Bind only to localhost instead of publishing to internet
docker run -p 127.0.0.1:3306:3306 mysql
# Instead of
docker run -p 3306:3306 mysql

UFW Rules Saved But Disappear After Reboot

# Check if UFW service is enabled
systemctl is-enabled ufw
systemctl enable ufw

# Check UFW backup files
ls /etc/ufw/
cat /etc/ufw/user.rules

iptables Rules Lost After Reboot

iptables is not persistent by default. You must install and save the rules:

apt install iptables-persistent
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6

Rate Limiting Is Working But Blocking Your Own IP

ufw limit ssh blocks IPs connecting more than 6 times in 30 seconds. To whitelist your own IP:

# Whitelist your IP — place this rule before the limit rule
ufw allow from YOUR_HOME_IP to any port 22

Frequently Asked Questions

Can UFW and iptables work together?

Yes. UFW is a wrapper around iptables, so they're compatible. If you need additional complex rules, add them to /etc/ufw/before.rules instead of running iptables separately.

How do I reset UFW and start fresh?

ufw reset        # Remove all rules and disable
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

Do I need a firewall if I'm using Cloudflare?

Yes. Cloudflare only protects traffic routed through it. If an attacker discovers your real VPS IP address, they can connect directly. It's best practice to block all IPs except Cloudflare ranges in your UFW rules.

Summary

UFW is sufficient for most VPS setups. Configure a deny-all policy and only open ports you actually need. Regularly check ufw status to ensure no unintended ports are exposed.