Overview

ufw (Uncomplicated Firewall) is the default front-end for iptables/nftables on Ubuntu and Debian. This article shows you how to install and configure ufw on your Pod so that only the services you run are reachable, while keeping SSH open.

Before you begin

• An Ubuntu or Debian Pod with sudo access.
• A note of the SSH port you use (default 22).

Steps

1. Install ufw if it is not already present:

bash sudo apt update sudo apt install -y ufw

1. Allow SSH before enabling the firewall, otherwise you will lock yourself out:

```bash sudo ufw allow OpenSSH

or, for a custom port:

sudo ufw allow 2222/tcp ```

1. Allow the other services you need, for example:

bash sudo ufw allow 80/tcp sudo ufw allow 443/tcp

You can restrict a rule to a source address, e.g. sudo ufw allow from 203.0.113.5 to any port 3306.

1. Enable the firewall and confirm it starts at boot:

bash sudo ufw enable sudo ufw status verbose

1. Review and manage rules:

bash sudo ufw status numbered sudo ufw delete <rule-number>

Recommended default policy

Deny incoming and allow outgoing unless you have a reason not to:

bash sudo ufw default deny incoming sudo ufw default allow outgoing

Troubleshooting

• Problem: You are locked out of SSH. Solution: Recover access through the Console VNC/console feature and run sudo ufw allow OpenSSH, or disable with sudo ufw disable.
• Problem: A service is unreachable even though the port is allowed. Solution: Remember the ALYPOD cloud firewall in the Console sits in front of the Pod; make sure the port is open there too.
• Problem: Docker rules bypass ufw. Solution: Docker manages its own iptables chains; publish container ports carefully or use the ALYPOD cloud firewall.

Related articles

• [Configuring a firewall with firewalld]
• [Troubleshooting network connectivity]