Configure the UFW firewall

A VPS with a public IPv6 address is reachable by everyone as soon as a service listens. UFW (Uncomplicated Firewall) gives the kernel filter a readable interface: you describe allowed ports, it generates IPv4 and IPv6 rules. The classic mistake is enabling the firewall before allowing SSH, which cuts the current session.

Allow SSH first

sudo ufw allow 22/tcp

If you changed the SSH port, allow the right number. Check what actually listens:

sudo ss -tlnp | grep ssh

Do not trust the default: a rule on port 22 while sshd listens on 2222 locks you out. The panel console is the fallback, but avoid needing it.

Default policy

sudo ufw default deny incoming
sudo ufw default allow outgoing

All incoming traffic not explicitly allowed is refused, all outgoing traffic is accepted. This base suits a classic web server. If your app reaches a remote database, outgoing stays open; for a very closed server you can restrict later, but start simple so updates do not break.

HTTP, HTTPS and IPv6

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

ufw enable asks for confirmation: answer yes only after allowing SSH. Rules must show (v6). UFW filters IPv6 when IPV6=yes is set in /etc/default/ufw, which is the Debian default. If the marker is missing, fix that file and reload with sudo ufw reload.

To enable an application profile shipped by a package:

sudo ufw app list
sudo ufw allow 'Nginx Full'

Nginx Full covers 80 and 443, over both IPv4 and IPv6.

Docker and bypassed rules

Docker inserts its own rules ahead of UFW's. A container published on 0.0.0.0:8080 stays reachable from the internet even if UFW denies 8080. This is the most common trap.

• Publish ports on 127.0.0.1:8080:8080 and use an Nginx reverse proxy.
• Or use a dedicated tool such as ufw-docker to sync the chains.
• Test from outside, not only with ufw status.

On a system container Docker may already hit storage or permission errors: test before depending on it.

Verify and troubleshoot

sudo ufw status numbered
sudo ufw delete NUMERO
sudo journalctl -u ufw --since today

status numbered gives numbers for deleting a rule. If you lose SSH after enabling, reopen the console, run sudo ufw disable, fix the rule, then re-enable. A deny rule placed before an allow on the same port wins: order matters. Finish with a real test from another machine, over IPv4 and IPv6, rather than trusting the listing alone.