Skip to content
Client area

Help Centre › VPS and servers

How do I set up a firewall on an unmanaged VPS?

Use the firewall that comes with your Linux system: ufw on Ubuntu and Debian, or firewalld on AlmaLinux, Rocky Linux and CentOS. Allow SSH first, then only the ports your apps need, and then switch the firewall on.

Ubuntu and Debian: ufw

  1. Install it if needed: apt update && apt install ufw. Ubuntu usually has it already.
  2. Set the defaults: ufw default deny incoming and ufw default allow outgoing.
  3. Allow SSH before anything else: ufw allow 22/tcp, or your own SSH port if you changed it.
  4. Allow your website: ufw allow 80,443/tcp.
  5. Switch it on with ufw enable and answer y. Check the result with ufw status verbose.

AlmaLinux, Rocky Linux and CentOS: firewalld

  1. Install and start it: dnf install firewalld (or yum on older systems), then systemctl enable --now firewalld.
  2. Check SSH is allowed: firewall-cmd --list-all should show ssh under services. If you use another SSH port, add it: firewall-cmd --permanent --add-port=2222/tcp.
  3. Allow your website: firewall-cmd --permanent --add-service=http --add-service=https.
  4. Apply the changes with firewall-cmd --reload, then run firewall-cmd --list-all again.

Locked yourself out? Open the VNC console in the VPS control panel (client area → Services → your VPS) and fix the rule from there: it doesn’t go through the firewall.

Good habits

  • Keep databases private. Don’t open MySQL (3306), PostgreSQL (5432) or MongoDB (27017) to the world. If another server needs access, allow only its address, for example ufw allow from 198.51.100.7 to any port 3306 proto tcp.
  • Watch out for Docker. Ports published with docker run -p skip ufw rules. Publish them on 127.0.0.1 only (for example -p 127.0.0.1:8080:80) and put a web server in front.
  • Stop password guessing. Use SSH keys and install fail2ban, which blocks addresses that keep failing to log in.
  • Be careful limiting SSH to one IP. Unless your connection has a fixed IP, your address changes on mobile data or at home, and you would need the console to get back in.
  • Behind Cloudflare? You can allow ports 80 and 443 only from Cloudflare’s IP ranges, so attackers can’t reach the server directly.

An unmanaged VPS means the software on the server is yours to run, but if the console doesn’t get you back in, open a support ticket or message us on WhatsApp, Monday to Friday, 08:00–17:00 CAT.

Updated 6 November 2026. Something here out of date? Tell us.

Ask us on WhatsApp