Published: 02.08.2026
A firewall decides which network traffic may reach your server. On a VPS the right rules close most attack paths in a few minutes.
The principle
Block everything that comes from outside by default, and open only the ports that your services need. Outgoing traffic is usually allowed.
UFW on Ubuntu and Debian
UFW (Uncomplicated Firewall) is a friendly front end for the Linux packet filter.
- Set the default rules:
ufw default deny incomingandufw default allow outgoing. - Allow SSH before you enable the firewall:
ufw allow 22/tcp(use your SSH port). - Allow web traffic:
ufw allow 80,443/tcp. - Enable it:
ufw enableand check withufw status verbose.
Restrict by address
If you always connect from a fixed address, allow SSH only from it: ufw allow from 203.0.113.5 to any port 22. For databases, allow only the application server.
nftables
Modern distributions use nftables. Rules are kept in a configuration file with tables and chains; the logic is the same: drop by default, accept established connections, accept loopback and open the required ports.
Cloud firewall
Many providers offer a firewall at the network level. It blocks traffic before it reaches the server, saving resources. Use both levels for the best result.
Common mistakes
- Enabling the firewall without allowing SSH and losing access.
- Leaving the database port open to the world.
- Forgetting IPv6 rules.
- Not saving the rules, so they disappear after a reboot.
Test
Check from outside with a port scanner that only the expected ports respond. Repeat the test after each change.
Frequently asked questions
Does a firewall replace updates? No. It limits access, but vulnerable software must still be patched.
