Setting up a firewall on your VPS
Configure UFW on Ubuntu/Debian or firewalld on AlmaLinux to protect your VPS from unauthorized access. Includes essential port rules and SSH lockdown guidance.
UnderHost NOC
Network Operations
On this page
A firewall controls which network connections are allowed to reach your server. On a fresh VPS exposed to the internet, a firewall is one of the first things you should configure. Always allow SSH before enabling the firewall to avoid locking yourself out.
Add your SSH allow rule BEFORE enabling the firewall. If you enable the firewall without allowing port 22, you'll lock yourself out of the server. If this happens, open a ticket from the VPS service in CustomerPanel and the NOC will help you get back in.
UFW on Ubuntu/Debian
UFW (Uncomplicated Firewall) is the recommended firewall tool for Ubuntu and Debian:
# Allow SSH (CRITICAL-do this first)
ufw allow 22/tcp
# Allow web traffic
ufw allow 80/tcp
ufw allow 443/tcp
# Enable UFW
ufw enable
# Check status
ufw status verbose
# Block a specific IP
ufw deny from 192.168.1.1
# Remove a rule
ufw delete allow 80/tcpfirewalld on AlmaLinux/Rocky
# Start and enable firewalld
systemctl start firewalld
systemctl enable firewalld
# Allow SSH, HTTP, HTTPS
firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
# Apply changes
firewall-cmd --reload
# List all rules
firewall-cmd --list-allCommon port reference
| Port | Service | Open by default? |
|---|---|---|
| 22 | SSH | Required for management |
| 80 | HTTP | Required for websites |
| 443 | HTTPS | Required for websites |
| 21 | FTP | Optional-use SFTP (22) instead |
| 25 | SMTP (outbound) | Blocked by default-open a ticket to request |
| 587/465 | SMTP Submission | Open if running a mail server |
| 110/995 | POP3 | Open if running a mail server |
| 143/993 | IMAP | Open if running a mail server |
| 3306 | MySQL | Block-only open if needed remotely |
| 7800 | aaPanel | Open only if running aaPanel |
SSH security hardening
Additional steps to secure SSH beyond the firewall:
- Change the SSH port-Move from 22 to a non-standard port (e.g. 2222) to reduce automated attacks
- Disable root password login-Use SSH key authentication only; disable PasswordAuthentication in
/etc/ssh/sshd_config - Install fail2ban-Automatically blocks IPs after repeated failed login attempts
- Allow only specific IPs-If your IP is static, restrict SSH to just your IP:
ufw allow from YOUR.IP.HERE to any port 22
Related: How to connect to your VPS via SSH | How to manage your Cloud VPS | Updating packages on your Linux VPS | VPS emergency console in CustomerPanel (coming soon)
Need a Cloud VPS?
Launch an UnderHost Cloud VPS when you need root access, dedicated resources, custom software, or more control than shared hosting.
