The Problem
Setting up a fresh Ubuntu server means repeating the same UFW dance every time: allow SSH, allow the web ports, deny everything else, enable — and one typo away from locking yourself out. Across multiple client servers, this manual process was both tedious and risky.
The Solution
I wrote an interactive shell script that turns firewall setup into a guided menu instead of memorized commands.
- Guided setup wizard — detects active SSH sessions and whitelists them automatically before enabling UFW
- Profile presets — web server, database server, or full custom mode
- Port manager — add/remove allowed ports with validation and duplicate detection
- Dry-run mode — preview every rule before anything is applied
- Panic switch — single command to disable the firewall if something goes wrong
Technical Notes
Pure Bash with no external dependencies beyond ufw itself, so it runs on any minimal Ubuntu/Debian install. The script wraps every destructive operation behind confirmation prompts and logs all changes with timestamps for auditing.
Impact
New server hardening dropped from ~15 careful minutes to under 2, and — more importantly — the “locked myself out over SSH” failure mode is designed out entirely. It’s now part of my standard provisioning checklist for every Linux deployment.
Sample: the panic switch
The single most useful piece of the whole script — three lines that have saved me at 2am more than once:
#!/usr/bin/env bash
set -euo pipefail
ufw --force reset
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw --force enable
echo "[ok] firewall reset to safe defaults"Warning — The panic switch is intentionally destructive. Treat it as an emergency brake, not a config tool. Use the wizard for normal setup.
