UFW

The numbers output by UFW's `status numbered` are generated dynamically and are not persistent identifiers; internally UFW maintains a linked list in the order rules were added, and deletion changes the indices of subsequent nodes.

UFW (Uncomplicated Firewall) provides a concise command-line interface on top of the underlying network filtering capabilities to simplify firewall configuration.

The core idea of UFW configuration is to deny incoming by default and allow outgoing by default.

UFW's default policy is set via the `ufw default` command, and the common combination is `ufw default deny incoming` with `ufw default allow outgoing`.

Before enabling UFW, SSH must be allowed first, otherwise the remote connection will be cut off and can only be fixed through the cloud provider's console (VNC or serial).

`ufw allow ssh` works because UFW looks up the port corresponding to ssh in `/etc/services` (default 22/tcp) and expands it into a port rule.

UFW rules are in a pending state before being enabled; `ufw show added` shows the list of rules not yet applied, and `ufw status` shows inactive when not enabled.

UFW has built-in application profiles, so `ufw allow 'Nginx Full'` or `ufw allow 'Apache Full'` opens both HTTP (80) and HTTPS (443) ports at once.

UFW application profiles are stored in the `/etc/ufw/applications.d/` directory as INI-format files, and are registered automatically when Nginx or Apache is installed.

`ufw app list` lists the currently available application profiles, and `ufw app info 'Nginx Full'` shows exactly which ports that profile opens.

UFW supports specifying a source IP in rules, for example `ufw allow from 203.0.113.10 to any port 3306`, and this can be narrowed further with `proto tcp`.

If the management side uses a dynamic IP, an IP whitelist will frequently fail, and in that case it is better to layer on a VPN or bastion host solution rather than relying solely on IP rules.

UFW rules can be deleted in two ways: by rule content (`ufw delete allow 80`) or by number (first check the number with `ufw status numbered`, then `ufw delete <number>`).

When deleting UFW rules by number, the numbers of subsequent rules are rearranged after each deletion, so when deleting multiple rules in succession you should work from the highest number to the lowest.

Even if Ollama is already listening externally, if the UFW firewall has not allowed port 11434, you still need to run ufw allow 11434/tcp to establish connectivity.