Beginner5 min read
Firewall basics for a new server
Default-deny, the three rules almost everyone needs, and how not to lock yourself out.
Last updated 1 August 2026
Allow SSH before you enable the firewall
Enabling a default-deny policy without an SSH rule ends your session and does not let you back in. Console access, where the plan supports it, is the way back.A starting ruleset
bash
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 80,443/tcp
ufw enable
ufw status verboseNarrow it further
If you always connect from a known network, restrict SSH to it. That single change removes most of the noise from your logs.
bash
ufw delete allow 22/tcp
ufw allow from 198.51.100.0/24 to any port 22 proto tcpWas this page useful?
Feedback about article firewall-basics