Manage the Firewall on Your VPS

A host firewall is the second layer of defence in depth on any server: even if a service is listening, nothing reaches it unless you said so. On current-generation NoBull Networks VPS and VDS plans the firewall lives inside your server, managed with the operating system's own tools. This guide covers UFW (Ubuntu and Debian), firewalld (AlmaLinux and Rocky), and Windows Defender Firewall, plus the one rule that matters more than all the others.

Plan your rules#

Write down which ports need to be reachable, and from where. A typical web server needs SSH (22) from your locations, HTTP (80) and HTTPS (443) from anywhere, and nothing else. Databases, admin panels, and monitoring agents should usually be reachable only from specific IPs or over a VPN, not the whole internet.

UFW on Ubuntu and Debian#

UFW ("Uncomplicated Firewall") is preinstalled on Ubuntu and available on Debian with apt install ufw.

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH             # or: sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

Restrict a port to one source, delete a rule, or allow ping (ICMP is allowed by default in UFW's rules):

sudo ufw allow from 198.51.100.7 to any port 5432 proto tcp   # Postgres from one IP
sudo ufw delete allow 80/tcp
sudo ufw status numbered && sudo ufw delete 3                # delete by number

firewalld on AlmaLinux and Rocky Linux#

firewalld is the default on Enterprise Linux and works with zones and services:

sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

Open an arbitrary port, or limit one to a source with a rich rule:

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="198.51.100.7" port port="5432" protocol="tcp" accept'
sudo firewall-cmd --reload

Windows Server#

Windows Defender Firewall is on by default and blocks unsolicited inbound traffic. Remote Desktop (3389) is allowed on server images so you can get in; add rules for anything else in Windows Defender Firewall with Advanced Security, or from an elevated PowerShell:

New-NetFirewallRule -DisplayName "Web HTTP"  -Direction Inbound -Protocol TCP -LocalPort 80  -Action Allow
New-NetFirewallRule -DisplayName "Web HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow
Get-NetFirewallRule -Direction Inbound -Enabled True | Select DisplayName, Action

Strongly consider limiting the RDP rule to your own IP addresses, or putting RDP behind a VPN; open RDP is the most attacked service on the internet.

Verify from outside#

From another machine, confirm what is actually reachable rather than what you think is:

nmap -Pn -p 22,80,443,3306,5432 203.0.113.10
nc -vz 203.0.113.10 443

Slow down brute force#

fail2ban watches logs and inserts temporary firewall bans for repeat offenders. Install it alongside your firewall on Linux; it works with both UFW and firewalld out of the box.

Legacy note: the hypervisor firewall#

Earlier-generation VPS products offered a firewall managed from the client portal that ran on the host node outside your operating system, with rules for source, protocol, and macros such as SSH. That option applied to those Gen1 products only. Current-generation servers do not use it; the in-guest firewalls above are the supported approach, and they are more flexible besides.

Related#

• Set Up SSH Key Authentication
• First Steps on a New Linux Server
• Acceptable Use, Spam, and Abuse Reports, including how outbound mail is filtered