When you are trying to set up a new Linux server, dealing with firewalls can get quite overwhelming. Here’s a beginner’s guide to firewalls on Linux.

Traffic into or out of a computer is filtered through “ports,” which are relatively arbitrary designations appended to traffic packets destined for use by a particular application.

By convention, some ports are routinely used for particular types of applications. For example, port 80 is generally used for insecure web browsing and port 443 is used for secure web browsing.

Traffic to particular applications can be allowed or blocked by “opening” or “closing” (i.e. filtering) the ports designated for a particular type of traffic. If port 80 is “closed,” for example, no (insecure) web browsing will be possible.

The default firewall configuration tool for Ubuntu is ufw. It stands for uncomplicated firewall. Developed to ease iptables firewall configuration, ufw provides a user-friendly way to create an IPv4 or IPv6 host-based firewall. By default ufw is disabled.

By default, ufw will block all of the incoming connections and allow all outbound connections. This means that anyone trying to access your server will not be able to connect unless you specifically open the port, while all applications and services running on your server will be able to access the outside world.

Install Uncomplicated Firewall:

sudo apt install ufw

Allow SSH before enabling the firewall, otherwise you will lock yourself out.

sudo ufw allow ssh

If SSH is running on a different port than the default 22, use

sudo ufw allow 23/tcp

Enable Firewall:

sudo ufw enable

Check status:

sudo ufw status verbose

e.g. If everything worked so far, you will get the following output

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
22/tcp (v6)                ALLOW IN    Anywhere (v6)

Open a specific application protocol on the default port:

sudo ufw allow http

Open a specific port:

sudo ufw allow 80/tcp

Allow connections for an application profile, such as NGINX:

sudo ufw allow 'Nginx'

To check which application profiles are installed,

sudo ufw app list

Only allow connection from certain IP address:

sudo ufw allow from 1.2.3.4 (to any port 80)

Deny all connections from certain IP address:

sudo ufw deny from 1.2.3.4 (to any port 80)

Delete firewall rules:

sudo ufw deny 80/tcp

or, first get a numbered list of all rules and then delete it:

sudo ufw status numbered 
sudo ufw delete 3

Source: UFW documentation