> ## Documentation Index
> Fetch the complete documentation index at: https://docs.digitalfyre.com/llms.txt
> Use this file to discover all available pages before exploring further.

# UFW Firewall Basics

UFW (Uncomplicated Firewall) is a user-friendly frontend for iptables, available by default on most Debian and Ubuntu systems. This guide covers installation, common rules, and DigitalFyre-specific considerations.

## Installation

**Debian / Ubuntu**

```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
apt update && apt install ufw -y
```

**RHEL / AlmaLinux / Rocky**

UFW is not included by default on RHEL-based distributions. These systems use `firewalld` instead, but UFW can be installed if preferred:

```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
dnf install epel-release -y
dnf install ufw -y
```

## Initial Setup

> [!WARNING]
>
> Before enabling UFW, **always allow SSH first**. If you enable UFW without an SSH rule, you will lose access to your server and need to use the VirtFusion console (VPS) or IPMI (Bare Metal) to recover.

```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
# Allow SSH before anything else
ufw allow 22/tcp

# Set default policies
ufw default deny incoming
ufw default allow outgoing

# Enable the firewall
ufw enable
```

Confirm with `ufw status verbose` to verify your rules are active.

## Common Rules

### Allow by Port

```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
# Web traffic
ufw allow 80/tcp
ufw allow 443/tcp

# Custom SSH port
ufw allow 2222/tcp

# Allow a port range
ufw allow 6000:6010/tcp
```

### Allow by IP Address

```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
# Allow a specific IP to all ports
ufw allow from 203.0.113.50

# Allow a specific IP to a specific port
ufw allow from 203.0.113.50 to any port 22

# Allow a subnet
ufw allow from 10.0.0.0/8
```

### Deny and Rate Limiting

```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
# Deny a specific IP
ufw deny from 198.51.100.0/24

# Rate limit SSH (blocks IPs with 6+ connection attempts in 30 seconds)
ufw limit 22/tcp
```

### Deleting Rules

```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
# List rules with numbers
ufw status numbered

# Delete by number
ufw delete 3

# Delete by rule definition
ufw delete allow 80/tcp
```

## DigitalFyre-Specific Considerations

### VPS (VirtFusion)

DigitalFyre VPS servers use **cloud-init** for initial provisioning and **qemu-guest-agent** for host communication. These services operate at the hypervisor level and are not affected by UFW rules inside your VPS. You are free to configure your firewall however you need.

### Managed Services

If you have a managed service with DigitalFyre, you will need to allow access for DigitalFyre's management infrastructure:

* **Jump Server IPs** — Required for support team SSH access. Request these IPs from [support](https://console.digitalfyre.com/submitticket.php).
* **Monitoring Probe IPs** — Required for proactive server monitoring. Request these IPs from [support](https://console.digitalfyre.com/submitticket.php).

```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
# Example: allow DigitalFyre jump server
ufw allow from <JUMP_SERVER_IP> to any port 22

# Example: allow DigitalFyre monitoring probe
ufw allow from <MONITORING_PROBE_IP>
```

### Uptime Monitoring

DigitalFyre uses [UptimeRobot](https://uptimerobot.com/) for uptime monitoring. If you restrict ICMP or HTTP/HTTPS traffic, you may need to allowlist UptimeRobot's probe IPs to avoid false downtime alerts.

UptimeRobot publishes its probe IP list at: [uptimerobot.com/inc/files/ips/IPv4andIPv6.txt](https://uptimerobot.com/inc/files/ips/IPv4andIPv6.txt)

At minimum, allow **ICMP** (ping) and **HTTP/HTTPS** (ports 80 and 443) from these addresses.

## Useful Commands

| Command | Description |
| - | - |
| `ufw status` | Show current rules and status |
| `ufw status verbose` | Show rules with default policies |
| `ufw status numbered` | Show rules with line numbers (for deletion) |
| `ufw reload` | Reload rules without disabling |
| `ufw disable` | Disable the firewall (all rules inactive) |
| `ufw reset` | Reset to defaults and disable (removes all rules) |
| `ufw app list` | Show available application profiles |

## Recovery

If you lock yourself out:

1. **VPS** — Log in through the VirtFusion console (accessible from the customer portal) and run `ufw disable` or `ufw allow 22/tcp`
2. **Bare Metal** — Access the server through IPMI/KVM and correct the rules
3. If you cannot access the console, contact [support](https://console.digitalfyre.com/submitticket.php) for assistance


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.