Ubuntu 26.04 LTS – UFW blocks application traffic after enabling firewall – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Services become unreachable immediately after UFW is enabled.

Environment & Reproduction

Typical with default deny policy and missing allow rules for app ports.

sudo ufw status verbose
ss -lntup
ip -br addr
systemctl status ufw --no-pager

Root Cause Analysis

Required inbound rules are absent or applied to wrong interface/protocol.

Quick Triage

Map listening sockets to required firewall rules.

ss -lntup
sudo ufw status numbered
sudo ufw app list

Step-by-Step Diagnosis

Test from a remote host while reviewing UFW logs for drops.

sudo tail -n 100 /var/log/ufw.log
sudo journalctl -u ufw -n 80 --no-pager
sudo ufw show raw

Solution – Primary Fix

Add explicit allow rules, reload firewall, and verify service exposure.

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw reload
sudo ufw status verbose

Solution – Alternative Approaches

Apply interface-scoped or source-scoped rules for tighter control.

sudo ufw allow in on eth0 from 10.0.0.0/24 to any port 22 proto tcp
sudo ufw allow from 192.168.1.10 to any port 5432 proto tcp

Verification & Acceptance Criteria

Accepted when remote checks pass and denied traffic is limited to unintended sources.

sudo ufw status numbered
curl -I http://localhost
ssh localhost exit

Rollback Plan

If rules are misapplied, remove by index and restore previous policy.

sudo ufw status numbered
sudo ufw delete NUMBER
sudo ufw reload

Prevention & Hardening

Define baseline UFW profiles and test ingress paths before production enforcement.

sudo ufw app update all
sudo ufw default deny incoming
sudo ufw default allow outgoing

Related Errors & Cross-Refs

Related issues include SSH lockout, service timeout, and unexpected DROP entries in ufw.log.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

UFW documentation, iptables-nft behavior on Ubuntu, and service port hardening guidance.