The fix works as expected in B/C: #COSMIC ubuntu@c-ufw:~$ dpkg -l | grep ufw ii ufw 0.36-0ubuntu0.18.10.1 all program for managing a Netfilter firewall ubuntu@c-ufw:~$ sudo ufw status numbered Status: active To Action From -- ------ ---- [ 1] 22/tcp ALLOW IN Anywhere [ 2] Anywhere ALLOW IN 1.2.3.4 [ 3] 22/tcp (v6) ALLOW IN Anywhere (v6) [ 4] Anywhere (v6) ALLOW IN 2001:db8::/32 ubuntu@c-ufw:~$ sudo ufw prepend deny from 6.7.8.9 Rule inserted ubuntu@c-ufw:~$ sudo ufw prepend deny from 2a02:2210:12:a:b820:fff:fea2:25d1 Rule inserted (v6) ubuntu@c-ufw:~$ sudo ufw status numbered Status: active To Action From -- ------ ---- [ 1] Anywhere DENY IN 6.7.8.9 [ 2] 22/tcp ALLOW IN Anywhere [ 3] Anywhere ALLOW IN 1.2.3.4 [ 4] Anywhere (v6) DENY IN 2a02:2210:12:a:b820:fff:fea2:25d1 [ 5] 22/tcp (v6) ALLOW IN Anywhere (v6) [ 6] Anywhere (v6) ALLOW IN 2001:db8::/32 #BIONIC ubuntu@b-ufw:~$ dpkg -l | grep ufw ii ufw 0.36-0ubuntu0.18.04.1 all program for managing a Netfilter firewall ubuntu@b-ufw:~$ sudo ufw status numbered Status: active To Action From -- ------ ---- [ 1] 22/tcp ALLOW IN Anywhere [ 2] Anywhere ALLOW IN 1.2.3.4 [ 3] 22/tcp (v6) ALLOW IN Anywhere (v6) [ 4] Anywhere (v6) ALLOW IN 2001:db8::/32 ubuntu@b-ufw:~$ sudo ufw prepend allow from 2001:db8::/32 Skipping inserting existing rule (v6) ubuntu@b-ufw:~$ sudo ufw status numbered Status: active To Action From -- ------ ---- [ 1] 22/tcp ALLOW IN Anywhere [ 2] Anywhere ALLOW IN 1.2.3.4 [ 3] 22/tcp (v6) ALLOW IN Anywhere (v6) [ 4] Anywhere (v6) ALLOW IN 2001:db8::/32 ubuntu@b-ufw:~$ sudo ufw prepend deny from 6.7.8.9 Rule inserted ubuntu@b-ufw:~$ sudo ufw prepend deny from 2a02:2210:12:a:b820:fff:fea2:25d1 Rule inserted (v6) ubuntu@b-ufw:~$ sudo ufw status numbered Status: active To Action From -- ------ ---- [ 1] Anywhere DENY IN 6.7.8.9 [ 2] 22/tcp ALLOW IN Anywhere [ 3] Anywhere ALLOW IN 1.2.3.4 [ 4] Anywhere (v6) DENY IN 2a02:2210:12:a:b820:fff:fea2:25d1 [ 5] 22/tcp (v6) ALLOW IN Anywhere (v6) [ 6] Anywhere (v6) ALLOW IN 2001:db8::/32