UFW Firewall Management

Managing the UFW Firewall

UFW (Uncomplicated Firewall) is the default firewall on BlitzPress servers. It provides a simple interface to iptables for managing incoming and outgoing traffic rules.

Default BlitzPress Rules

BlitzPress configures these rules during setup:

sudo ufw status verbose

Port	Service	Status
22/tcp	SSH	ALLOW
80/tcp	HTTP	ALLOW
443/tcp	HTTPS	ALLOW
7080/tcp	OLS WebAdmin	ALLOW (specific IPs only)

Common Operations

# Check status
sudo ufw status numbered

# Allow a port
sudo ufw allow 8080/tcp

# Allow a port from specific IP only
sudo ufw allow from 1.2.3.4 to any port 3306

# Deny a port
sudo ufw deny 8080/tcp

# Delete a rule by number
sudo ufw status numbered
sudo ufw delete 5

# Allow port range
sudo ufw allow 6000:6010/tcp

Email Server Ports (Postal)

If using BlitzPress’s Postal mail server, open these ports:

sudo ufw allow 25/tcp    # SMTP
sudo ufw allow 587/tcp   # SMTP submission
sudo ufw allow 465/tcp   # SMTPS

Allowing Specific IPs

For sensitive services like database access or the OLS WebAdmin panel:

# Allow MySQL from specific IP
sudo ufw allow from 10.0.0.5 to any port 3306

# Allow OLS WebAdmin from office
sudo ufw allow from YOUR_OFFICE_IP to any port 7080

Rate Limiting

UFW has built-in rate limiting for SSH (denies connections from IPs with 6+ attempts in 30 seconds):

sudo ufw limit ssh

Emergency: Locked Out

If you accidentally block yourself, access the server via your hosting provider’s console (KVM/VNC) and run:

sudo ufw allow from YOUR_IP to any port 22
# or disable entirely
sudo ufw disable

Best Practices

• Default policy should be deny incoming, allow outgoing
• Only open ports that are actively needed
• Use IP-specific rules for admin interfaces (OLS WebAdmin, phpMyAdmin)
• Always ensure port 22 is allowed before enabling UFW