To configure a firewall on your VPS, you can use iptables (full control, steeper learning curve) or UFW (a simplified front-end for iptables, ideal for beginners). Both tools are available on most Linux distributions and protect your server by blocking unauthorized network traffic.
A VPS without a firewall is an open door: every port your services listen on can be probed by automated bots around the clock. This guide covers the essential iptables and UFW commands so your server is protected in under 30 minutes.
Why Does Your VPS Need a Firewall?
When you spin up a VPS, you get a public IP address reachable from anywhere on the Internet. Without a firewall, any service you run — MySQL, Redis, admin panels — is visible to automated scanners that test for vulnerabilities and weak passwords 24/7.
A properly configured firewall lets you:
- Expose only the ports you actually need (80, 443, 22).
- Drop all unsolicited inbound traffic by default.
- Rate-limit SSH connections to stop brute-force attacks.
- Isolate internal services (databases, caches) from the public network.
Before starting, connect to your VPS via SSH and make sure you have superuser privileges (sudo or a root session).
Option A: Set Up a Firewall with UFW (Recommended for Beginners)
UFW (Uncomplicated Firewall) is an abstraction layer on top of iptables that makes rule management straightforward. It comes pre-installed on Ubuntu and is easy to add on Debian and CentOS.
Install and Enable UFW
# Debian / Ubuntu
sudo apt install ufw -y
# Check status
sudo ufw status verbose
Important: allow SSH before enabling UFW so you don't lock yourself out.
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
If you use a custom SSH port (for example, 2222):
sudo ufw allow 2222/tcp
Enable UFW and Set the Default Policy
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable
Confirm with y when prompted. Your firewall is now active. Verify the rules with:
sudo ufw status numbered
Everyday UFW Commands
| Action | Command |
|---|---|
| Allow a port | sudo ufw allow 3306/tcp |
| Block a port | sudo ufw deny 3306/tcp |
| Delete a rule (by number) | sudo ufw delete 3 |
| Allow only from one IP | sudo ufw allow from 192.168.1.10 to any port 22 |
| Disable UFW | sudo ufw disable |
Option B: Configure a Firewall with iptables (Advanced Control)
iptables is Linux's native packet-filtering tool built into the kernel. It offers granular control but demands careful attention, especially around rule ordering.
Flush Existing Rules
sudo iptables -F
sudo iptables -X
sudo iptables -Z
Set Default Policy (DROP Inbound)
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT
Allow Essential Traffic
# Loopback (required by the OS)
sudo iptables -A INPUT -i lo -j ACCEPT
# Established and related connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# SSH
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# HTTP and HTTPS
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
# ICMP (ping) — optional but useful for diagnostics
sudo iptables -A INPUT -p icmp -j ACCEPT
Persist Rules Across Reboots
iptables rules are lost on reboot unless you save them:
# Debian / Ubuntu
sudo apt install iptables-persistent -y
sudo netfilter-persistent save
# CentOS / RHEL
sudo service iptables save
Security Best Practices
An active firewall is the first step; these practices strengthen it further:
- Change the SSH port (from 22 to something in the 2200–2299 range) to cut down log noise.
- Rate-limit SSH with UFW:
sudo ufw limit sshblocks IPs that make more than 6 failed attempts in 30 seconds. - Block high-risk countries using ipset + iptables if you receive persistent attacks from specific regions.
- Never expose MySQL or Redis to the Internet (ports 3306 and 6379); bind them to
127.0.0.1in their config files. - Review logs regularly:
/var/log/ufw.log(UFW) ordmesg(iptables with logging enabled).
If you manage multiple servers, check our VPS servers blog category for deeper coverage of advanced security configurations.
Key Takeaways
- A VPS without a firewall exposes all its ports to the Internet from day one.
- UFW is the fastest, safest choice for beginners; iptables delivers full control for advanced scenarios.
- The correct baseline policy is: deny all inbound traffic and explicitly allow only what you need.
- Always allow SSH before enabling the firewall to avoid locking yourself out.
- Persist your rules with
iptables-persistentornetfilter-persistentso they survive reboots. - Combine the firewall with SSH public-key authentication for solid protection without added complexity.
Looking for a VPS that comes pre-hardened and ready to go? The team at elenlace.com can help you pick and fine-tune the right server for your project, with support in Spanish and English.
FAQ
Can UFW and iptables coexist?
Yes — UFW is a front-end for iptables. When you use UFW, you are modifying iptables under the hood. Avoid mixing direct iptables commands with UFW on the same server, as the rules can conflict unpredictably.
What if I accidentally lock myself out of SSH?
Access your VPS through the emergency console (KVM/VNC) provided by your hosting provider. From there you can disable the firewall (sudo ufw disable or sudo iptables -P INPUT ACCEPT) and fix the rules safely.
Do I need a firewall if I already run fail2ban?
Yes. fail2ban reacts after detecting failed attempts; a firewall with a DROP policy blocks traffic before it even reaches the service. They are complementary tools, not substitutes for each other.
Should I open port 8080 for my web application?
Only if the application listens directly on that port and you are not using a reverse proxy (Nginx/Apache). Best practice is to expose only ports 80 and 443 and let the proxy route traffic internally to your app.
Prefer it done for you? El Enlace handles hosting and professional web development.
Compare providers
Other providers and guides worth comparing:
