> The full list of articles is in [llms.txt](https://docs.f3cloud.com/llms.txt). Every page has a Markdown version: add .md to its address. This page as Markdown: [https://docs.f3cloud.com/en/client-area/protect-vps-from-unauthorised-access/firewall.md](https://docs.f3cloud.com/en/client-area/protect-vps-from-unauthorised-access/firewall.md).

# Setting up the UFW and firewalld firewall on a Linux VPS

How to set up a firewall on a VPS and close unneeded ports. Step-by-step setup of UFW for Ubuntu and Debian and firewalld for AlmaLinux, CentOS and Oracle Linux, with SSH access only from your IP.

A firewall decides which connections are let into the server and which are not. The idea is simple. Only the services you actually use should be visible from the outside. The fewer ports are open, the lower the chance that someone finds a vulnerability in one of them.

Usually you only need to open a few.

* **SSH** – port `22`, or your own one if you have [changed it](https://docs.f3cloud.com/en/client-area/protect-vps-from-unauthorised-access/change-ssh-port.md);
* **a website** – ports `80` and `443`;
* **a VPN or proxy** – the ports your program uses, for example `443` for VLESS.

> **Allow SSH first.**
>
> If you turn on the firewall without allowing SSH, you will immediately lose access to the server. So run the commands strictly in order.

***

### Setting up the firewall

The commands are run on the server.

#### Ubuntu and Debian (UFW)

```bash
# Install UFW (on Ubuntu it is usually already there)
sudo apt update
sudo apt install -y ufw

# By default, block all incoming connections and allow outgoing
# ones
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH. If you have changed the port, put yours instead of 22
sudo ufw allow 22/tcp

# If a website runs on the server, open HTTP and HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Turn on the firewall. When asked about existing SSH connections,
# answer y
sudo ufw enable

# See which rules are in effect
sudo ufw status verbose
```
#### AlmaLinux, CentOS, Oracle Linux (firewalld)

```bash
# Install firewalld and make it start automatically
sudo dnf install -y firewalld
sudo systemctl enable --now firewalld

# See what is already open. SSH is usually allowed here by
# default
sudo firewall-cmd --list-all

# If a website runs on the server, open HTTP and HTTPS
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https

# Apply the changes
sudo firewall-cmd --reload
```

If you later need to open another port, for example `8080` for a control panel, it takes just one command.

#### Ubuntu and Debian (UFW)

```bash
# Open port 8080 for TCP connections
sudo ufw allow 8080/tcp
```
#### AlmaLinux, CentOS, Oracle Linux (firewalld)

```bash
# Open port 8080 for TCP connections and apply the changes
sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload
```

***

### SSH only from your IP address

This is the strongest measure, because only you will be able to connect over SSH, and the port will be closed to everyone else. You can find out your IP address on [2ip.ru](https://2ip.ru).

> **Only for a static IP.**
>
> This step is only suitable if you have a static IP address. Many home internet providers change it from time to time, and once the address changes, you will not be able to log in over SSH and will have to use the console instead. If you are not sure your IP is static, skip this step.

#### Ubuntu and Debian (UFW)

```bash
# Allow SSH only from your IP. Replace YOUR_IP with your address,
# and 22 with your SSH port if you have changed it
sudo ufw allow from YOUR_IP to any port 22 proto tcp

# Delete the general rule that let everyone reach SSH
sudo ufw delete allow 22/tcp

# Check the list of rules
sudo ufw status
```
#### AlmaLinux, CentOS, Oracle Linux (firewalld)

```bash
# Allow SSH only from your IP. Replace YOUR_IP with your address,
# and 22 with your SSH port if you have changed it
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="YOUR_IP" port port="22" protocol="tcp" accept'

# Remove the standard SSH service that was open to everyone
sudo firewall-cmd --permanent --remove-service=ssh

# Apply the changes and check the result
sudo firewall-cmd --reload
sudo firewall-cmd --list-all
```

> **If you lose access after all.**
>
> If you lose access after all, open the server with the <kbd>Console</kbd> button in the server list in your client area and temporarily turn off the firewall.\
> On Ubuntu and Debian, the command is `sudo ufw disable`.\
> On AlmaLinux, CentOS and Oracle Linux, it is `sudo systemctl stop firewalld`.
>
> Then fix the rules and turn the firewall back on.

***

### Our resources

**Telegram channel:** [https://t.me/f3cloud_news](https://t.me/f3cloud_news)\
**F3 Cloud:** [https://f3cloud.com](https://f3cloud.com/en)