A firewall decides which connections are let into the server and which are not. The idea is simple. Only the services you actually use should be visible from the outside. The fewer ports are open, the lower the chance that someone finds a vulnerability in one of them.

Usually you only need to open a few.

• SSH – port 22, or your own one if you have changed it;
• a website – ports 80 and 443;
• a VPN or proxy – the ports your program uses, for example 443 for VLESS.

Allow SSH first

If you turn on the firewall without allowing SSH, you will immediately lose access to the server. So run the commands strictly in order.

---

Setting up the firewall

The commands are run on the server.

# Install UFW (on Ubuntu it is usually already there)
sudo apt update
sudo apt install -y ufw

# By default, block all incoming connections and allow outgoing
# ones
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH. If you have changed the port, put yours instead of 22
sudo ufw allow 22/tcp

# If a website runs on the server, open HTTP and HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Turn on the firewall. When asked about existing SSH connections,
# answer y
sudo ufw enable

# See which rules are in effect
sudo ufw status verbose

# Install firewalld and make it start automatically
sudo dnf install -y firewalld
sudo systemctl enable --now firewalld

# See what is already open. SSH is usually allowed here by
# default
sudo firewall-cmd --list-all

# If a website runs on the server, open HTTP and HTTPS
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https

# Apply the changes
sudo firewall-cmd --reload

If you later need to open another port, for example 8080 for a control panel, it takes just one command.

# Open port 8080 for TCP connections
sudo ufw allow 8080/tcp

# Open port 8080 for TCP connections and apply the changes
sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload

---

SSH only from your IP address

This is the strongest measure, because only you will be able to connect over SSH, and the port will be closed to everyone else. You can find out your IP address on 2ip.ru.

Only for a static IP

This step is only suitable if you have a static IP address. Many home internet providers change it from time to time, and once the address changes, you will not be able to log in over SSH and will have to use the console instead. If you are not sure your IP is static, skip this step.

# Allow SSH only from your IP. Replace YOUR_IP with your address,
# and 22 with your SSH port if you have changed it
sudo ufw allow from YOUR_IP to any port 22 proto tcp

# Delete the general rule that let everyone reach SSH
sudo ufw delete allow 22/tcp

# Check the list of rules
sudo ufw status

# Allow SSH only from your IP. Replace YOUR_IP with your address,
# and 22 with your SSH port if you have changed it
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="YOUR_IP" port port="22" protocol="tcp" accept'

# Remove the standard SSH service that was open to everyone
sudo firewall-cmd --permanent --remove-service=ssh

# Apply the changes and check the result
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

If you lose access after all

If you lose access after all, open the server with the Console button in the server list in your client area and temporarily turn off the firewall.
On Ubuntu and Debian, the command is sudo ufw disable.
On AlmaLinux, CentOS and Oracle Linux, it is sudo systemctl stop firewalld.

Then fix the rules and turn the firewall back on.

---

Our resources

Telegram channel: https://t.me/f3cloud_news
F3 Cloud: https://f3cloud.com