How to Secure Jenkins Access on Linux with UFW (Allow Only Office IP)

Author: Vikas Rajpurohit
Purpose: Secure Jenkins (port 8080) by allowing access only from office Wi-Fi (static IP: xx.xx.xxx.xx) and denying all other external access.

✅ Objective

Jenkins is running on port 8080.
Office public IP is xx.xx.xxx.xx (static).
Restrict access to Jenkins from only this IP using ufw (Uncomplicated Firewall).

✅ Prerequisites

Ubuntu/Debian-based server with Jenkins installed.
Jenkins configured to run on port 8080 and listen on all interfaces (0.0.0.0).
ufw firewall is installed and active.
Access to the server with sudo privileges.

🔎 Current UFW Status Example

sudo ufw status numbered

Example output:

[12] 8080                      DENY        Anywhere
[13] 8080                      ALLOW       xx.xx.xxx.xx

❌ Problem: DENY rule comes before ALLOW. ufw applies the first match, so the ALLOW rule is ignored.

📄 Step-by-Step Firewall Fix

✅ Step 1: Delete Old Rules

sudo ufw delete allow from xx.xx.xxx.xx to any port 8080
sudo ufw delete deny 8080

✅ Step 2: Re-Add in Correct Order

sudo ufw allow from xx.xx.xxx.xx to any port 8080
sudo ufw deny 8080

✅ Step 3: Confirm Rule Order

sudo ufw status

Expected output:

8080                      ALLOW       xx.xx.xxx.xx
8080                      DENY        Anywhere
8080 (v6)                 DENY        Anywhere (v6)

🚀 Validate Jenkins Access

1. From Server:

curl http://localhost:8080

Should return Jenkins login redirect page HTML.

2. From Browser on Office Wi-Fi:

http://<Server IP>:8080

Should load Jenkins normally.

3. From Home or Any Other IP:

Should show:

ERR_CONNECTION_TIMED_OUT

🔎 Troubleshooting Case Summary

Issue	Diagnostic	Fix
Jenkins not accessible via browser	Curl worked from server, browser failed	Firewall rule order issue (DENY came before ALLOW)
Jenkins listening on localhost only	Used `netstat -tuln`	Confirmed Jenkins listening on `0.0.0.0:8080`
Wrong IP allowed	UFW rule had 23.34.213.233, but real IP was 23.34.213.232	Checked actual public IP using `https://whatismyipaddress.com`

✅ Final Notes

In ufw, first matching rule applies.
Always allow trusted IPs before denying access.
Use netstat to ensure services are listening on external interfaces.
Confirm external IP before applying allow rules.

Need to secure other ports (e.g. 3000, 5000)? Repeat same rule logic.

Done! Jenkins is now safely restricted to your office network.

🔒 How to Secure Jenkins Access on Linux with UFW (Allow Only Office IP)