Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following rules on our server within UFW:

To                         Action      From
--                         ------      ----
22                         ALLOW
22                         ALLOW
80                         ALLOW       Anywhere
443                        ALLOW       Anywhere
22/tcp                     ALLOW

The first two rules are our internal IP's which we want to ensure can always SSH in (port 22). The next two rules are to allow HTTP and HTTPS viewing from any IP addresses anywhere. The final rule is to allow SSH from our code deployment system.

I set a ufw default deny rule up but it doesn't appear to be showing. Should I also have a final rule which denies everything?

If I add a deny everything rule, does the order the rules appear above make a difference? Presumably if this list gets longer adding another allow rule above a deny rule is impossible, meaning I'll have to remove and re-add some rules?

share|improve this question

The command ufw status verbose will show you the default rule. For your configuration you probably want it to say

Default: deny (incoming), allow (outgoing)

In that case, you don't need a separate 'deny everything' rule, and the order of your other rules doesn't matter. If you do want to change the order, you can add a rule at a specific place by using ufw insert [position] [rule text]. You can get a numbered list of rules with ufw status numbered.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.