UFW on an Ubuntu laptop: enable it without locking yourself out

Ubuntu's UFW firewall is initially disabled, so a fresh install is not filtering until you enable it. Preview your rules with a dry run, allow SSH first if you connect remotely, then run sudo ufw enable and check the result with sudo ufw status verbose.

What UFW is

Ubuntu's documentation describes UFW, the Uncomplicated Firewall, as Ubuntu's default firewall configuration tool, built to ease iptables configuration. It creates IPv4 or IPv6 host-based firewalls. Its current back end is iptables-restore, with rules files in /etc/ufw.

The manual describes it as an easy way to add or remove simple rules, not as complete firewall functionality. That fits a laptop well. It does not fit a complicated router.

Check the state first

The documentation says UFW is initially disabled. Check what you have:

sudo ufw status verbose

If it reports inactive, nothing is being filtered by UFW.

The page used for this post does not state the default incoming and outgoing policies, so read them from the status output on your machine rather than assuming.

Do not lock yourself out

If you reach this machine over SSH, allow it before you enable the firewall. The documentation shows two forms:

sudo ufw allow ssh
sudo ufw allow 22

You can preview what a rule would do without applying it:

sudo ufw --dry-run allow ssh

Then turn UFW on:

sudo ufw enable

If you only use the laptop locally, you may not need to allow anything inbound.

Local development servers

Dev servers usually bind to localhost, and a host firewall that filters inbound traffic is not the issue for those. The trouble starts when a framework binds to all interfaces and you did not mean it to. Check what is listening:

ss -tlnp

If something you did not expect is listening on all interfaces, fix the binding first. A firewall is a second layer, not an excuse.

Forwarding and Docker

The documentation notes that DEFAULT_FORWARD_POLICY in /etc/default/ufw is set to ACCEPT for IP masquerading. If you run containers or share a connection, forwarding matters. Docker also manages its own firewall rules, and I cannot confirm from the pages used here how that interacts with UFW, so test published container ports from another machine before you rely on UFW to block them.

A short checklist

1. Run sudo ufw status verbose and note the state.
2. List what listens on your machine.
3. Allow only what you need, SSH included if relevant.
4. Dry run, then enable.
5. Test from another device on the same network.

For the code you run on the laptop, scanning dependencies is a separate step. Safeguard's free scan at gold.safeguard.sh/scan is one option.

Quick check

Sources

• Firewall (Ubuntu Server documentation)

Last reviewed: 19 October 2026.