How to configure a firewall

Quick answer: Use the firewall native to your distro: ufw on Ubuntu/Debian, firewalld on AlmaLinux/Rocky, or plain nftables anywhere. The safe pattern is the same everywhere: allow SSH first, allow the ports your services need (80/443 for web), deny everything else inbound, then enable the firewall.

Overview

A host firewall reduces your attack surface to only the services you intend to expose. Databases, admin panels and monitoring agents listening on public IPs are a top cause of compromises — a default-deny inbound policy hides them all. This article gives the distro-neutral picture; Ubuntu specifics are in configure firewall on Ubuntu and a deeper UFW guide in how to configure UFW firewall.

Before you start

• Root/sudo access and the list of ports your applications actually use.
• Your SSH port number — allow it before enabling anything.
• KVM Console access as the recovery path.

Step-by-step guide

1. Ubuntu/Debian (ufw):

   ufw allow OpenSSH
   ufw allow 80/tcp
   ufw allow 443/tcp
   ufw default deny incoming
   ufw default allow outgoing
   ufw enable
   ufw status verbose

2. AlmaLinux/Rocky (firewalld):

   systemctl enable --now firewalld
   firewall-cmd --permanent --add-service=ssh
   firewall-cmd --permanent --add-service=http --add-service=https
   firewall-cmd --reload
   firewall-cmd --list-all

3. Any distro (nftables): keep a minimal inbound chain with a default drop policy and explicit accepts for SSH and web ports; save it to /etc/nftables.conf and enable the service.
4. Verify from outside with nmap or an online port checker: only the intended ports should answer.

Common issues

• Enabled the firewall before allowing SSH: recover via the KVM Console and add the SSH rule.
• Service unreachable after enabling: its port is not allowed — check with ss -tlnp what is listening where.
• Docker bypasses ufw: Docker programs iptables directly; bind containers to 127.0.0.1 or configure Docker's iptables integration consciously.

When to contact support

Firewall configuration inside the OS is customer-managed. If you are fully locked out (SSH + KVM Console), or you need DDoS-scale filtering rather than a host firewall (DDoS protection overview), open a support ticket.

Frequently asked questions

Which firewall tool should I use on my VPS?

Use the native one: ufw on Ubuntu and Debian, firewalld on AlmaLinux and Rocky Linux. Both manage the same kernel packet filter and are much harder to misconfigure than raw rules.

What ports should stay open on a typical web server?

Only SSH (22 or your custom port), HTTP 80 and HTTPS 443. Databases, admin panels and monitoring agents should listen on localhost or be restricted to specific source IP addresses.

Does a host firewall protect me from DDoS attacks?

Only partially — it filters what reaches the OS, but a volumetric flood saturates the network link before your rules apply. Upstream filtering like the Cloud2Y DDoS option handles that layer.

Related articles

• How to configure UFW firewall
• How to configure firewall on Ubuntu
• How to install Fail2ban
• How to identify suspicious traffic

Need a hand? Contact Cloud2Y support →