Enable UFW safely

UFW controls the host firewall inside Ubuntu. The safe order matters: allow the active SSH path, verify the rule, then enable filtering.

First inspect the packaged SSH application profile:

sudo ufw app info OpenSSH

It should describe the TCP port used by the SSH service. If you deliberately moved SSH to another port, allow that exact port instead of assuming the profile is correct.

Preview and apply the rule:

sudo ufw --dry-run allow OpenSSH
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verbose

The final output should report an active firewall and an allow rule for SSH. Keep the current SSH session open because an established connection can survive a mistake that blocks new ones.

From another terminal, make a new connection:

ssh -i ~/.ssh/digitalocean_notes [email protected]

The new login is the real verification. A rule displayed by UFW is not enough if it opens the wrong port or a DigitalOcean Cloud Firewall blocks the traffic earlier.

DigitalOcean Cloud Firewalls and UFW are separate layers. A connection must be allowed by both. Keep the provider firewall narrow too, but change one layer at a time so a failure has one likely cause.

If the second login fails, do not close the first session. Recheck sudo ufw status numbered, the SSH listening port with sudo ss -lntp, and any Cloud Firewall attached to the Droplet. Delete an incorrect UFW rule by its displayed number:

sudo ufw delete 2

If every SSH session is lost, use the recovery console and run ufw disable temporarily while repairing the intended rule. Do not leave the firewall disabled as the final fix.

Your action is to prove that a second SSH connection succeeds, then save the output of sudo ufw status verbose in your private operations notes.