Enable UFW safely

UFW (Uncomplicated Firewall) is the host firewall that ships with Ubuntu. It decides which ports accept connections from the outside. Right now every port is open. We’ll close them all except SSH.

The order of operations is what keeps you out of trouble: allow SSH, check the rule, then turn the firewall on. Enable first and you lock yourself out.

Check what the profile does

Packages can register UFW application profiles, named bundles of ports. OpenSSH ships one. Look at it before trusting it:

sudo ufw app info OpenSSH

It should list 22/tcp. If you moved SSH to another port on purpose, allow that exact port instead of the profile.

Allow SSH, then enable

Preview the rule, apply it, turn the firewall on and look at the result:

sudo ufw --dry-run allow OpenSSH
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verbose

ufw enable warns that it may disrupt existing SSH connections. Answer y. The final output should say Status: active with a line like 22/tcp (OpenSSH) ALLOW IN Anywhere.

Keep your current SSH session open through all of this. An established connection usually survives a firewall mistake that would block a new one, so it is your way back in.

The real test is a new login

From another terminal, connect again:

ssh -i ~/.ssh/digitalocean_notes [email protected]

This login is the proof. A rule that shows up in ufw status means nothing if it opens the wrong port, or if something earlier in the path drops the traffic.

That “something earlier” is the DigitalOcean Cloud Firewall. It filters traffic before it reaches the Droplet, so a connection must pass both layers. Keep the Cloud Firewall tight too, but change one layer at a time. When a login fails, you want one likely cause, not two.

When the second login hangs

Don’t close the first session. In it, run sudo ufw status numbered to see the rules with their numbers, sudo ss -lntp to confirm which port SSH is listening on, and check any Cloud Firewall attached to the Droplet. Delete a wrong rule by number:

sudo ufw delete 2

If you lost every session, open the recovery console and run ufw disable just long enough to fix the rule. Then enable it again. A disabled firewall is not a fix.

Once the second connection works, save the output of sudo ufw status verbose in your operations notes. You’ll compare against it every time you open a port.