/flags /ufw/ufw-status-numbered

ufw status numbered: list rules with numbers and delete one by number

updated 2026-10-24

tool: ufw
command: ufw
flag: status numbered
default: ufw status lists rules without numbers

sudo ufw status numbered prints the active ufw rules with their position in brackets, [ 1], [ 2] and so on. Those numbers are what ufw delete NUM and ufw insert NUM RULE expect, so the usual workflow for removing a rule you no longer know the exact syntax of is: list with numbers, then sudo ufw delete 3. Plain ufw status shows the same rules without numbers, and ufw status verbose adds the default policies and logging level instead.

Workflow

bash

sudo ufw status numbered        # find the rule
sudo ufw delete 3               # asks for confirmation, then deletes rule 3
sudo ufw --force delete 3       # same, without the prompt (scripts)
sudo ufw status numbered        # numbers have shifted: check again

ufw delete NUM shows the rule and asks Proceed with operation (y|n)?; --force skips the question, which is what scripts need.

Status variants

Command	Shows
ufw status	Whether ufw is active, then To / Action / From for each rule
ufw status numbered	The same rules prefixed with [N] positions
ufw status verbose	Rules plus logging level, default policies (incoming, outgoing, routed) and new profiles
ufw show added	Rules in the command form you typed them, even when ufw is inactive
ufw show listening	Listening ports and the rules that apply to them

In the status output, Anywhere means any address (0.0.0.0/0 for IPv4, ::/0 for IPv6), and rules generated for IPv6 carry a (v6) suffix.

Deleting by number or by specification

Method	Example	Removes
By number	ufw delete 3	Exactly one entry, IPv4 or IPv6
By specification	ufw delete allow 22/tcp	The rule for both IPv4 and IPv6
Reset everything	ufw reset	All rules; firewall disabled

The manual points out the IPv6 detail: deleting a generic rule by number deletes only the specified entry, while prefixing the original rule with delete removes both. For starting over, see reset all ufw rules.

Pitfalls

Inactive firewall. When ufw is disabled, status numbered prints only Status: inactive; use ufw show added to see the saved rules.
Insert positions. ufw insert N uses the same numbering; see ufw insert and prepend for blocking an address ahead of existing allow rules, as in block an IP address.
Rules from other tools. Rules added with iptables directly, by Docker or by fail2ban are not ufw rules and do not appear in the numbered list.

FAQ

Why did ufw delete 3 not remove the IPv6 rule as well?

IPv4 and IPv6 versions of a rule are separate numbered entries (the IPv6 one is marked (v6)). Deleting by number removes only that entry; the manual recommends deleting by rule specification, ufw delete allow 22/tcp, to remove both at once.

Why did the numbers change after I deleted a rule?

Numbers are positions, not IDs. After every delete or insert the following rules move up or down, so run ufw status numbered again before the next delete.

What is the difference between status, status verbose and status numbered?

status lists active rules; verbose adds the default policies, logging level and new profiles; numbered prefixes each rule with its position for delete and insert.

Sources

commands · ufwsudo ufw reset: delete all ufw rules and start oversudo ufw reset disables ufw and restores the packaged rules files, keeping timestamped backups. What it removes, --force, restoring and rebuilding safely.commands · ufwufw block an IP address: sudo ufw insert 1 deny from 203.0.113.7Block an IP with ufw insert 1 deny from ADDR or ufw prepend. Why a plain deny after allow rules does nothing, IPv6 positions, Docker ports and checking order.flags · ufwufw insert 1 / ufw prepend: put a deny rule before existing allow rulesufw insert 1 and ufw prepend put a deny rule before existing allow rules, since ufw appends by default and the first match wins. When to use each, and pitfalls.cheat sheets · ufwufw cheat sheet: enable, allow, deny, delete and route rulesufw cheat sheet: enable safely over SSH, set default policies, allow, deny, limit and delete rules, route rules, app profiles, logging and the Docker caveat.