Set up a firewall on your VPS with UFW or firewalld

A firewall decides which network connections can reach your VPS. The safest set-up is to block all incoming connections by default, then allow only the services you actually use, such as SSH and your websites. This guide uses UFW on Ubuntu and Debian, and firewalld on AlmaLinux and Rocky Linux.

It works on every operating system we offer: Ubuntu 22.04, 24.04 and 26.04, Debian 12 and 13, AlmaLinux 8, 9 and 10, and Rocky Linux 9 and 10.

Important: always allow SSH before you turn the firewall on. If you turn on a firewall that blocks SSH, you'll be locked out of your server straight away. If you've moved SSH to a different port, such as 2222, allow that port instead of 22. If you do get locked out, you can still log in with Open Console and fix it. See Use the web console to access your VPS.

Before you start

• SSH access as root or as a user with sudo rights. If you're logged in as root, you can leave sudo off the commands.
• Know which port SSH uses. It's 22 unless you've changed it. To check, run sudo sshd -T | grep -i '^port'.
• A list of the services people need to reach from the internet, for example SSH, websites (ports 80 and 443) or an app on its own port.
• Use one firewall tool only: UFW on Ubuntu and Debian, or firewalld on AlmaLinux and Rocky. Running both at once gives confusing results.

Step 1: Check whether a firewall is installed and running

Depending on the operating system you chose, a firewall may not be installed, or may be installed but turned off. Check first.

Ubuntu/Debian

sudo ufw status

• Status: inactive: UFW is installed but turned off. Ubuntu usually includes UFW, turned off.
• Status: active: UFW is on, and your rules are listed underneath.
• command not found: UFW isn't installed. This is normal on Debian.

AlmaLinux/Rocky

sudo firewall-cmd --state

• running: firewalld is on.
• not running: firewalld is installed but turned off.
• command not found: firewalld isn't installed.

Step 2: Install the firewall if it's missing

Ubuntu/Debian

sudo apt update
sudo apt install -y ufw

AlmaLinux/Rocky

sudo dnf install -y firewalld

Don't turn it on yet.

Step 3: Block incoming connections by default, and allow SSH

Ubuntu/Debian with UFW

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp

If SSH uses a different port, allow that port as well, for example sudo ufw allow 2222/tcp.

AlmaLinux/Rocky with firewalld

firewalld already blocks incoming connections by default. Its standard zone, public, only allows a few services, including SSH on port 22. If SSH uses port 22, there's nothing to do in this step.

If SSH uses a different port, add it now. If firewalld is not running yet, use:

sudo firewall-offline-cmd --add-port=2222/tcp

If firewalld is already running, use:

sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload

Step 4: Turn the firewall on

Ubuntu/Debian with UFW

sudo ufw enable

UFW warns that the command may disrupt existing SSH connections. As long as you allowed SSH in Step 3, type y and press Enter. UFW now starts automatically whenever the server boots.

AlmaLinux/Rocky with firewalld

sudo systemctl enable --now firewalld

Now test it. Keep your current SSH window open, and open a new SSH connection to the server. If the new connection works, you're safe. If it doesn't, use the window that's still open to fix the rule, or turn the firewall off with sudo ufw disable (Ubuntu/Debian) or sudo systemctl stop firewalld (AlmaLinux/Rocky).

Step 5: Allow websites and other services

Only open the ports you need. Some common examples:

Ubuntu/Debian with UFW

# Websites (HTTP and HTTPS)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# An app on its own port, for example 3000
sudo ufw allow 3000/tcp

# A UDP port, for example WireGuard
sudo ufw allow 51820/udp

AlmaLinux/Rocky with firewalld

sudo firewall-cmd --permanent --add-service=http --add-service=https
sudo firewall-cmd --permanent --add-port=3000/tcp
sudo firewall-cmd --permanent --add-port=51820/udp
sudo firewall-cmd --reload

With firewalld, --permanent saves the rule so it survives a reboot, and --reload applies it. If you leave out --permanent, the rule works straight away but disappears on the next reload or reboot.

Tip: if your app sits behind a web server or reverse proxy, such as Nginx, only ports 80 and 443 need to be open. There's no need to open the app's own port as well.

Step 6: Allow a port from one IP address only

Some services, such as a database or an admin panel, should only be reachable from your own office or home. Replace 203.0.113.10 with your IP address and 3306 with the port.

Ubuntu/Debian with UFW

sudo ufw allow from 203.0.113.10 to any port 3306 proto tcp

AlmaLinux/Rocky with firewalld

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.10" port port="3306" protocol="tcp" accept'
sudo firewall-cmd --reload

If your internet connection doesn't have a fixed (static) IP address, it can change, and you'll lose access until you update the rule. Think twice before limiting SSH this way.

Step 7: Check, list and delete rules

Ubuntu/Debian with UFW

# Show whether UFW is on, the default policies and all rules
sudo ufw status verbose

# Show the rules with numbers
sudo ufw status numbered

# Delete a rule by its number
sudo ufw delete 3

# Or delete a rule by repeating it after "delete"
sudo ufw delete allow 3000/tcp

Rule numbers change after each deletion, so run sudo ufw status numbered again before you delete another rule.

AlmaLinux/Rocky with firewalld

# Show whether firewalld is running
sudo firewall-cmd --state

# Show the allowed services, ports and rich rules
sudo firewall-cmd --list-all

# Remove a port, a service or a rich rule, then reload
sudo firewall-cmd --permanent --remove-port=3000/tcp
sudo firewall-cmd --permanent --remove-service=http
sudo firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="203.0.113.10" port port="3306" protocol="tcp" accept'
sudo firewall-cmd --reload

On AlmaLinux and Rocky, the services list may include cockpit, a web admin panel. If you don't use Cockpit, remove it with sudo firewall-cmd --permanent --remove-service=cockpit, then reload.

If you use Docker

Docker manages its own firewall rules. When you publish a container port, for example with -p 8080:80 or a ports: line in Docker Compose, that port can be reachable from the internet even if UFW or firewalld would block it. Docker's traffic is redirected before UFW's rules are checked, and with firewalld, Docker sets up its own zone that accepts the traffic.

To keep a container private, publish it on the server's local address only, then reach it through a reverse proxy such as Nginx Proxy Manager:

# With docker run
docker run -d -p 127.0.0.1:8080:80 nginx

# In docker-compose.yml
    ports:
      - "127.0.0.1:8080:80"

To see what's published, run sudo docker ps and check the PORTS column. 0.0.0.0:8080->80/tcp means the port is open to the world. 127.0.0.1:8080->80/tcp means only the server itself can reach it.

Troubleshooting

• You're locked out of SSH: log in with Open Console on your VPS's management page. Turn the firewall off with ufw disable (Ubuntu/Debian) or systemctl stop firewalld (AlmaLinux/Rocky), allow your SSH port as in Step 3, then turn the firewall back on.
• Your website stopped loading: allow ports 80 and 443 (Step 5).
• A firewalld rule disappeared after a reboot: it was added without --permanent. Add it again with --permanent, then run sudo firewall-cmd --reload.
• The port is open but the service still can't be reached: check the service is running and listening with sudo ss -tlnp. A service listening on 127.0.0.1 only accepts connections from the server itself.

Related guides

• Secure your new VPS: a checklist for the first 15 minutes
• Protect SSH from brute-force attacks with Fail2ban
• Use the web console to access your VPS
• Fix common SSH connection errors
• Install Docker Engine and Docker Compose on your VPS

Need help?

Our Cloud VPS plans are self-managed, so you're responsible for installing, securing and maintaining the software on your server. If something on our side isn't working, such as the network, or your VPS won't boot, open a support ticket. New to your VPS? Start with our Cloud VPS Getting Started Guide.