Knowledgebase

What is UFW and Why It’s Important

UFW (Uncomplicated Firewall) is a user-friendly interface for managing Linux firewall rules based on iptables/nftables.
It is designed to make server security simple, readable, and safe, especially for VPS and production servers.

Why you should use UFW

• Blocks unauthorized access to your server

• Protects against brute-force and port scanning

• Allows only required services (SSH, HTTP, HTTPS, etc.)

• Easy to manage compared to raw iptables

• Works well with Cloudflare, Docker, and hosting stacks

Supported Systems

• Ubuntu 18.04+

• Debian 10+

• Compatible with most modern Linux distributions

Step 1: Install UFW

apt update -y ; apt upgrade -y
apt install ufw -y

Verify installation:

ufw version

Step 2: Allow SSH (VERY IMPORTANT)

Always allow SSH before enabling UFW, otherwise you may lock yourself out.

Allow SSH using service name (default port 22)

ufw allow ssh

Allow SSH on default port explicitly (22)

ufw allow 22/tcp

Allow SSH on a custom port (example: 2222)

ufw allow 2222/tcp

Allow SSH without specifying port (not recommended, but valid)

ufw allow OpenSSH

Step 3: Allow Web Traffic (HTTP & HTTPS)

ufw allow 80/tcp
ufw allow 443/tcp

Or using application profile:

ufw allow 'Nginx Full'

Step 4: Enable UFW

ufw enable

Check status:

ufw status verbose

Step 5: Cloudflare-Only Access (Advanced / Recommended)

If your website is behind Cloudflare, you should only allow Cloudflare IP ranges to access ports 80 & 443.

This prevents:

• Direct IP access bypassing Cloudflare

• Origin IP exposure

• Layer-7 attacks hitting your server directly

Cloudflare UFW Allow Script

Create the script:

nano allow-cloudflare-ufw.sh

Paste the following:

#!/bin/bash

# Exit on error
set -e

# Cloudflare IPv4 ranges
CF_IPV4=(
  173.245.48.0/20
  103.21.244.0/22
  103.22.200.0/22
  103.31.4.0/22
  141.101.64.0/18
  108.162.192.0/18
  190.93.240.0/20
  188.114.96.0/20
  197.234.240.0/22
  198.41.128.0/17
  162.158.0.0/15
  104.16.0.0/13
  104.24.0.0/14
  172.64.0.0/13
  131.0.72.0/22
)

# Cloudflare IPv6 ranges
CF_IPV6=(
  2400:cb00::/32
  2606:4700::/32
  2803:f800::/32
  2405:b500::/32
  2405:8100::/32
  2a06:98c0::/29
  2c0f:f248::/32
)

echo "Allowing Cloudflare IPv4 ranges..."
for ip in "${CF_IPV4[@]}"; do
  ufw allow from "$ip" to any port 80,443 proto tcp
done

echo "Allowing Cloudflare IPv6 ranges..."
for ip in "${CF_IPV6[@]}"; do
  ufw allow from "$ip" to any port 80,443 proto tcp
done

echo "Reloading UFW..."
ufw reload

echo "Done. Cloudflare IPs allowed."

Make it executable:

chmod +x allow-cloudflare-ufw.sh

Run it:

./allow-cloudflare-ufw.sh

Recommended Final Firewall Policy (Cloudflare Setup)

After running the script:

ufw default deny incoming
ufw default allow outgoing

Ensure SSH is still allowed:

ufw status numbered

Important Notes

• Cloudflare IP ranges change occasionally
  Update this script every few months from Cloudflare’s official IP list

• Do NOT block SSH from Cloudflare rules

• If you use:

  • cPanel

  • DirectAdmin

  • CyberPanel
    make sure required service ports are also allowed

Quick Troubleshooting

Locked out?

Use your provider’s VNC / Rescue / Console to disable UFW:

ufw disable

Reset UFW completely:

ufw reset

Summary

• UFW is essential for server security

• Always allow SSH before enabling

• Use Cloudflare-only rules to hide origin IP

• Keep rules minimal and explicit

• Test after every change