How to set up a firewall on a VPS (UFW and firewalld)

A server on the internet starts getting scanned right away. A firewall leaves open only the ports you actually need, such as SSH (22), HTTP (80) and HTTPS (443).

Always allow SSH before enabling the firewall, or you'll lose access to the server.

Ubuntu and Debian: UFW

Install it and set the rules:

apt update && apt install -y ufw
ufw default deny incoming
ufw default allow outgoing
ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

Check the result:

ufw status verbose

Open a port for your IP only (for example, for a database):

ufw allow from 198.51.100.10 to any port 5432 proto tcp

To delete a rule: ufw status numbered, then ufw delete NUMBER.

AlmaLinux and Rocky Linux: firewalld

dnf install -y firewalld
systemctl enable --now firewalld
firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload
firewall-cmd --list-all

Allow a port from a specific address only:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="198.51.100.10" port port="5432" protocol="tcp" accept'
firewall-cmd --reload

Docker and the firewall

Docker adds its own iptables rules and can expose a container port bypassing UFW. Publish ports on the local address only if they don't need to be public:

ports:
  - "127.0.0.1:5432:5432"

Protection against password guessing

Also install fail2ban — it bans an IP after several failed login attempts:

apt install -y fail2ban      # or dnf install -y fail2ban
systemctl enable --now fail2ban

If you need protection for several servers at once, VPN and network segmentation, take a look at our virtual firewall service.