Every server you deploy—whether it is a donation portal, a file share, or a Raspberry Pi monitoring station—is a potential target for automated attacks. Firewalls are the first line of defense, yet many small organizations skip them because the configuration feels intimidating. UFW (Uncomplicated Firewall) exists precisely to solve that problem. It wraps the powerful iptables system in plain-language commands that a volunteer can learn in an afternoon and remember for years.
Cost and Ownership
Firewalls are not a product you buy; they are a configuration you own. Learning UFW means your organization is never dependent on a cloud provider's security panel or a managed-hosting upsell. The skill transfers to every Linux server your team ever touches, from a $5 VPS to a recycled desktop running Ubuntu.
Training a volunteer on UFW also builds confidence. Network security stops being a black box and becomes a series of deliberate, reversible choices. When a new port is opened, the person doing it understands exactly why.
Checking UFW Status
UFW comes pre-installed on Ubuntu and Raspberry Pi OS. Check its current state:
sudo ufw status verbose
If it says "Status: inactive," you have no firewall protection yet. Do not enable it blindly—you could lock yourself out of SSH.
Safe First Steps
Before enabling UFW, explicitly allow SSH access:
sudo ufw allow ssh
If your SSH runs on a non-standard port, specify it:
sudo ufw allow 2222/tcp
Now enable the firewall:
sudo ufw enable
The system will warn you that enabling may disrupt existing SSH connections. If you allowed SSH correctly, confirm and proceed.
Allowing Services and Ports
For a web server, allow HTTP and HTTPS:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
You can also allow by service name if the name is recognized:
sudo ufw allow 'Nginx Full'
To allow a specific IP address full access:
sudo ufw allow from 192.168.1.50
To allow that IP only on a specific port:
sudo ufw allow from 192.168.1.50 to any port 3306
Denying Access
Blocking is equally straightforward:
sudo ufw deny 3306/tcp
This blocks all access to the MySQL/MariaDB port. If a specific IP is probing your server:
sudo ufw deny from 203.0.113.45
Rate Limiting
UFW can throttle repeated connection attempts, which is excellent for protecting SSH from brute-force attacks:
sudo ufw limit ssh
By default, this allows six connections in 30 seconds from a single IP. Anything beyond that is temporarily blocked.
Viewing and Deleting Rules
List rules with numbers:
sudo ufw status numbered
Delete a rule by number:
sudo ufw delete 3
Or delete by matching the original command:
sudo ufw delete allow 80/tcp
A Starter Policy for Nonprofit Servers
Here is a conservative policy suitable for most small organization servers:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
Only add additional ports when a specific service absolutely requires it, and document each exception in your server runbook.
Training Checklist for Volunteers
Give new maintainers a printed card with these five commands:
sudo ufw status— see what is opensudo ufw allow <port>— open a port deliberatelysudo ufw deny <port>— close a portsudo ufw limit ssh— protect against brute forcesudo ufw disable— emergency access if you accidentally lock yourself out (requires physical console access)
Practice the commands on a test Pi before touching production. The worst-case scenario is a locked-out server; the fix is usually plugging in a monitor and keyboard locally.
Why This Matters for Nonprofits
Managed hosting providers often charge premium rates for "security hardening" that consists of little more than a basic firewall. UFW gives your team that capability for free, on hardware you already own. More importantly, it teaches volunteers to treat network access as a conscious choice rather than a default setting. That mindset protects your donor database, your program files, and your participants' trust.