How to Configure a Firewall on a Linux VPS Print

How to Configure a Firewall on a Linux VPS

A firewall helps protect your Linux VPS by controlling which network connections are allowed or blocked. It is one of the most important basic security steps after deploying a new server.

ApnCloud Cloud VPS Hosting is an unmanaged service, so customers are responsible for configuring and maintaining their own firewall, operating system, software, applications, backups, and server security.

1. Connect to Your VPS Using SSH

First, connect to your Linux VPS using SSH.

ssh root@YOUR_SERVER_IP

Replace YOUR_SERVER_IP with your actual VPS IP address.

2. Check Which Firewall Is Available

Linux distributions may use different firewall tools.

• UFW
• firewalld
• nftables
• iptables

Ubuntu and Debian users often use UFW, while AlmaLinux and Rocky Linux commonly use firewalld.

3. Configure UFW on Ubuntu or Debian

If UFW is installed, check its current status:

ufw status

Before enabling the firewall, make sure SSH access is allowed:

ufw allow OpenSSH

If your SSH service uses a custom port, allow that port instead of relying only on the OpenSSH profile.

For a standard web server, you may also allow HTTP and HTTPS:

ufw allow 80/tcp
ufw allow 443/tcp

Then enable UFW:

ufw enable

Check the rules:

ufw status

4. Configure firewalld on AlmaLinux or Rocky Linux

Check whether firewalld is running:

systemctl status firewalld

If needed, start and enable it:

systemctl enable --now firewalld

Allow SSH:

firewall-cmd --permanent --add-service=ssh

For web hosting, you may also allow HTTP and HTTPS:

firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https

Reload the firewall:

firewall-cmd --reload

Then review the active rules:

firewall-cmd --list-all

5. Only Open Required Ports

A secure VPS should only expose ports that are actually needed.

• SSH
• HTTP
• HTTPS
• Application-specific ports

Do not open unnecessary ports, as every exposed service can increase security risk.

6. Be Careful with SSH Access

Before enabling or changing firewall rules, always confirm that your SSH port is allowed.

If SSH is blocked, you may lose remote access to your VPS.

It is a good idea to keep your current SSH session open while testing new firewall rules from a second terminal window.

7. Check Listening Services

You can review services listening on network ports with:

ss -tulpn

This can help you identify which applications are currently accepting network connections.

8. Test Your Website and Services

After applying firewall rules, test all important services.

• SSH still works
• Websites load
• HTTPS works
• Control panels remain accessible
• Required applications can connect
• Unnecessary ports are blocked

9. Review Firewall Rules Regularly

Firewall rules should be reviewed whenever you install, remove, or change server software.

Old or unused rules should be removed when they are no longer required.

Important Security Tips

• Keep your operating system updated
• Use strong passwords or SSH keys
• Do not expose unnecessary services
• Limit administrative access
• Monitor login activity
• Keep regular backups
• Review firewall rules after major software changes

Important: Unmanaged VPS Responsibility

ApnCloud Cloud VPS Hosting is provided as an unmanaged VPS service.

Customers are responsible for firewall configuration, server security, operating system administration, software installation, updates, backups, and application management.

Incorrect firewall settings may block legitimate access to your server, so make changes carefully.

Need Help?

If your VPS becomes unreachable because of an ApnCloud infrastructure or network issue, open a Support Ticket from your ApnCloud Client Area.

Include your VPS IP address and a clear description of the issue. Never include your root password or private SSH key in a support ticket.