Configure UFW on Ubuntu 24.04 without losing SSH access

On a remote server, enable UFW only after identifying and permitting the actual SSH port. Keep the current session open, have provider or physical console access ready, and use a second terminal for a new-connection test. The examples assume SSH on 22/tcp and do not replace any provider network firewall.

Check SSH and the port

Inspect listening TCP ports and the effective sshd configuration. With socket activation, ss can show systemd rather than sshd as the listener; do not filter solely on the process name. Inspect the OpenSSH UFW application profile before using it. If SSH listens on 2222, change every example rule accordingly.

sudo ss -lntp
sudo sshd -T | grep '^port '

Install and inspect status

Install UFW if needed. Status: inactive is normal on a new installation. Review existing rules, application ports, IPv6 and any external firewall before enabling it. Keep your administrator connection open.

sudo apt update
sudo apt install ufw
sudo ufw status verbose
sudo ufw app info OpenSSH

Set defaults and permit SSH

Deny new incoming connections, allow outgoing traffic and add an SSH rule before ufw enable. Use 22/tcp only when that is the real port. Alternatively use sudo ufw allow OpenSSH if its profile covers that port. Inspect the prepared rules with ufw show added.

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw show added

Enable and test another session

Enable UFW and inspect verbose status and numbered rules. Without closing the first session, connect from a second terminal and run a harmless command. An existing session does not prove that a new connection succeeds. If it fails, fix the rule using the open session or the recovery console.

sudo ufw enable
sudo ufw status verbose
sudo ufw status numbered

Restrict the source only after testing

The example permits SSH from documentation address 203.0.113.10; replace it with the real static public address the server sees. Before removing the general rule, test a new connection from that source. For changing addresses, IPv6 or multiple networks, plan matching rules and a recovery route.

sudo ufw allow proto tcp from 203.0.113.10 to any port 22
sudo ufw status numbered

Open only necessary services

A public website may need 80/tcp and 443/tcp. A firewall rule does not start a service, and a listening service is not necessarily reachable from outside. Restrict database and administration ports by source and interface rather than exposing them to everyone.

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw status numbered

Rate limits, rule order and IPv6

UFW limit reduces bursts of SSH connection attempts but does not replace key-based authentication. The sample deletes a general 22/tcp rule first: run it only if your rule matches exactly; otherwise inspect numbered rules and remove the correct entry. The first matching rule can take precedence. Check IPV6=yes when the server has public IPv6 and verify both address families.

sudo ufw delete allow 22/tcp
sudo ufw limit 22/tcp
grep '^IPV6=' /etc/default/ufw

Logs and diagnosis

Use moderate logging and check recent events. Compare listening ports, UFW rules and the provider firewall. Connection failure may also stem from SSH configuration, an intermediate network or a different source IP.

sudo ufw logging low
sudo journalctl -k --grep=UFW --since '30 minutes ago'
sudo ss -lntup

Recovery and reference

If the new session fails, leave the original one open. Inspect the SSH service and firewall rules; correct them in the existing session or from the provider console. Temporarily disabling UFW from a trusted console can aid emergency recovery, followed promptly by corrected rules. Official guide: https://documentation.ubuntu.com/server/how-to/security/firewalls/index.html .

sudo systemctl status ssh --no-pager
sudo ufw status numbered