How to Configure a Firewall on a Dedicated Server Print

How to Configure a Firewall on a Dedicated Server

A firewall helps protect your dedicated server by controlling incoming and outgoing network connections. Proper firewall configuration can reduce unnecessary exposure and help secure important services running on your server.

Follow the steps below to configure a basic firewall on a Linux-based ApnCloud Dedicated Server.

1. Connect to Your Dedicated Server Using SSH

First, connect to your server using SSH.

ssh root@YOUR_SERVER_IP

Replace YOUR_SERVER_IP with the actual IP address of your dedicated server.

2. Check Which Firewall Tool Is Available

Different Linux distributions may use different firewall tools.

• UFW
• firewalld
• nftables
• iptables

Ubuntu and Debian systems commonly use UFW, while AlmaLinux and Rocky Linux commonly use firewalld.

3. Configure UFW on Ubuntu or Debian

Check the current UFW status:

ufw status

Before enabling the firewall, make sure SSH access is allowed:

ufw allow OpenSSH

If your SSH service uses a custom port, allow that port before enabling UFW.

For a standard web server, allow HTTP and HTTPS:

ufw allow 80/tcp
ufw allow 443/tcp

Then enable UFW:

ufw enable

Check the active firewall rules:

ufw status

4. Configure firewalld on AlmaLinux or Rocky Linux

Check whether firewalld is running:

systemctl status firewalld

If needed, start and enable it:

systemctl enable --now firewalld

Allow SSH access:

firewall-cmd --permanent --add-service=ssh

Allow HTTP and HTTPS for web hosting:

firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https

Reload the firewall:

firewall-cmd --reload

Review the current firewall configuration:

firewall-cmd --list-all

5. Only Open Required Ports

Only allow ports that are actually required by your applications and services.

Common examples include:

• SSH
• HTTP
• HTTPS
• Control panel ports
• Application-specific ports

Do not open unnecessary ports because every exposed service can increase security risk.

6. Protect SSH Access

Before enabling or changing firewall rules, confirm that the correct SSH port is allowed.

If SSH is blocked by mistake, you may lose remote access to your server.

It is a good practice to keep your current SSH session open while testing new firewall rules from another terminal window.

7. Check Listening Ports

You can review which services are listening on network ports using:

ss -tulpn

This can help you identify active services and determine which ports actually need to be accessible.

8. Test Important Services

After applying firewall rules, test your important services.

• SSH access works
• Websites load correctly
• HTTPS works
• Control panels remain accessible
• Database or application connections work when required
• Unnecessary ports are not exposed

9. Review Firewall Rules Regularly

Firewall rules should be reviewed whenever you install, remove, or reconfigure server software.

Remove old or unused rules when they are no longer required.

Important Security Recommendations

• Keep the operating system updated
• Use strong passwords or SSH keys
• Limit administrative access
• Do not expose unnecessary services
• Monitor login activity
• Keep regular backups
• Review firewall rules after major server changes

Need Help?

If your Dedicated Server becomes unreachable because of an ApnCloud network, service, or infrastructure issue, please open a Support Ticket from your ApnCloud Client Area.

Include your server IP address and a clear description of the issue. Never include your root password or private SSH key in a support ticket.