To configure a firewall on your VPS and protect your website, install UFW (Uncomplicated Firewall), allow only the necessary ports (22, 80, 443), and block all other traffic. It's the fastest way to reduce the attack surface of a freshly provisioned Linux server.
A VPS without a firewall is a server with every door wide open. Internet bots scan entire IP ranges within minutes, looking for exposed ports, vulnerable services, and weak passwords. Setting up a firewall is the first security step you must complete before deploying any application.
What Is a Firewall and Why Does Your VPS Need One?
A firewall is a network traffic filter. It decides which incoming and outgoing connections are allowed based on rules you define. On a Linux VPS, the firewall operates at the operating system level and acts as the first line of defense before any request reaches your web server or application.
Without a firewall, every open port on your server is publicly accessible. That includes database management ports (3306 for MySQL), admin panels, and internal services that should never be visible from the internet.
UFW vs. iptables — Which Should You Use?
| Tool | Complexity | Best for | Main distros |
|---|---|---|---|
| UFW | Low | Admins who aren't networking experts | Ubuntu, Debian |
| firewalld | Medium | Environments with differentiated network zones | CentOS, Rocky Linux, RHEL |
| iptables / nftables | High | Advanced configurations and scripting | All Linux distros |
For most websites on a VPS, UFW offers the best balance between simplicity and control. This guide focuses on UFW, with firewalld equivalents at the end.
Setting Up UFW Step by Step (Ubuntu/Debian)
Step 1: Install and verify UFW
On most modern Ubuntu images, UFW is already installed. Check its status:
sudo apt update
sudo apt install ufw -y
sudo ufw statusStep 2: Set default policies
Before enabling the firewall, establish the base policies. The golden rule: deny all incoming traffic and allow all outgoing:
sudo ufw default deny incoming
sudo ufw default allow outgoingStep 3: Allow essential ports
Important: add SSH before enabling UFW or you will lose access to your server.
# SSH — remote server access
sudo ufw allow 22/tcp
# HTTP and HTTPS — web traffic
sudo ufw allow 80/tcp
sudo ufw allow 443/tcpIf you changed your SSH port for security (for example to 2222), replace 22 with the correct number.
Step 4: Enable the firewall
sudo ufw enableUFW will ask for confirmation. Type y and press Enter. From this point on, the firewall is active and will survive server reboots.
Step 5: Verify active rules
sudo ufw status verboseYou should see something like:
Status: active
To Action From
-- ------ ----
22/tcp ALLOW IN Anywhere
80/tcp ALLOW IN Anywhere
443/tcp ALLOW IN AnywhereAdditional Rules Based on Your Stack
Depending on the services you run on your VPS, you may need to open more ports. Do so only when strictly necessary:
- MySQL accessible remotely (only if needed):
sudo ufw allow from YOUR_IP to any port 3306— never open 3306 to the entire internet. - Mail server:
sudo ufw allow 25,587,465/tcp - FTP/SFTP: prefer SFTP (uses port 22, already allowed) over unencrypted FTP.
- Control panel (Plesk/Webmin):
sudo ufw allow 8443/tcp
The philosophy is least privilege: open only what you actively need and close everything else.
firewalld Equivalents (CentOS/Rocky Linux)
If your VPS uses a Red Hat-based distribution, the firewall manager is firewalld:
# Enable and start
sudo systemctl enable --now firewalld
# Allow web services and SSH
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --permanent --add-service=ssh
# Apply changes
sudo firewall-cmd --reload
# View status
sudo firewall-cmd --list-allFor an additional security layer in your infrastructure, check out the SSL security and servers section of our blog.
Key takeaways
- A firewall is the first line of defense for any VPS — configure it before deploying your application.
- The default-deny policy (
deny incoming) is the correct starting point; allow only what you need. - Always open the SSH port before enabling UFW so you don't lock yourself out.
- Never expose database ports (3306, 5432) to the public internet; restrict them to trusted IPs.
- UFW is the simplest option for Ubuntu/Debian; firewalld for Red Hat-based distros.
- Review and audit your rules periodically — needs change, and forgotten open ports are attack vectors.
Would you rather have a server that's already secured and managed by experts? At elenlace.com we offer managed VPS hosting with pre-configured firewalls, 24/7 monitoring, and Spanish-language technical support so you can focus on your business.
FAQ
Can enabling the firewall cause me to lose SSH access to my VPS?
Yes — if you enable UFW without first allowing port 22 (or whatever custom SSH port you use), you will lose remote access. If that happens, most VPS providers have an emergency console (VNC or KVM) accessible from their web panel that lets you reach the server directly to fix the issue.
Do I need a firewall if I'm already using Cloudflare?
Yes. Cloudflare protects HTTP/HTTPS web traffic, but if your server has other exposed ports (MySQL, SSH, control panels), Cloudflare doesn't cover those. The OS-level firewall protects all ports on your VPS regardless of what proxy sits in front of it.
What is the difference between UFW and my VPS provider's firewall?
VPS providers (DigitalOcean, Linode, Vultr, etc.) often offer a network-level firewall (before traffic reaches the server). It's an excellent additional layer, but complementary. UFW operates inside the operating system and allows more granular rules. Ideally, you should have both active.
How often should I review my firewall rules?
Review rules every time you install or uninstall a service, and at minimum every 3–6 months as a routine audit. Run sudo ufw status verbose to see what's open and question whether each port is still necessary.
Prefer it done for you? El Enlace handles hosting and professional web development.
Further reading
Other providers and guides worth comparing:
