How to Set Up a Firewall on Your VPS: UFW and iptables

A VPS firewall is your server's first real line of defense: it filters network traffic before it ever reaches any service and closes the thousands of ports that should never be publicly accessible. Without an active firewall, your server receives brute-force attempts, automated scanners, and exploit probes every single day — even minutes after you first power it on.

UFW vs. iptables: Which Should You Choose?

Both tools control the same Linux kernel subsystem (netfilter), but through very different interfaces:

General rule: if you're managing a Ubuntu or Debian VPS with standard services (web, SSH, mail), start with UFW. If you need NAT, advanced port forwarding, or run RHEL/AlmaLinux, use iptables (or its modern replacement, nftables).

Setting Up a Firewall with UFW

UFW (Uncomplicated Firewall) comes pre-installed on Ubuntu. If it's not available:

apt install ufw

Step 1: Set default policies

Before enabling UFW, define the base policy. The safest approach is to deny all incoming traffic and allow all outgoing:

ufw default deny incoming
ufw default allow outgoing

Step 2: Allow essential services

Critical: allow SSH before enabling the firewall or you will lose remote access.

# SSH (standard port)
ufw allow 22/tcp

# If you changed the SSH port (recommended):
ufw allow 2222/tcp

# Web server
ufw allow 80/tcp
ufw allow 443/tcp

# Mail (only if you manage an email server)
ufw allow 25/tcp
ufw allow 587/tcp
ufw allow 993/tcp

Step 3: Enable UFW

ufw enable

UFW will warn that it may disrupt active SSH connections. Since you already added the SSH rule, confirm with y.

Step 4: Verify the status

ufw status verbose

You'll see all active rules with their actions (ALLOW/DENY) and ports.

Additional useful UFW commands

• ufw deny 3306 — block MySQL from the outside (leave it on localhost only)
• ufw allow from 192.168.1.0/24 to any port 22 — SSH only from a LAN subnet
• ufw delete allow 80/tcp — remove an existing rule
• ufw reset — clear all rules and disable UFW

Setting Up a Firewall with iptables

iptables works with rule chains: INPUT (incoming traffic), OUTPUT (outgoing), and FORWARD (routed between interfaces). Rules are evaluated in order; the first match wins.

Secure base configuration

# Flush existing rules
iptables -F
iptables -X

# Default policy: deny everything
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback (essential for local processes)
iptables -A INPUT -i lo -j ACCEPT

# Allow established and related connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# HTTP and HTTPS
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# ICMP (ping) — optional but useful for diagnostics
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

Making rules persistent

iptables rules don't survive reboots by default. On Debian/Ubuntu:

apt install iptables-persistent
netfilter-persistent save

On CentOS/AlmaLinux:

service iptables save

Block an IP with iptables

iptables -A INPUT -s 1.2.3.4 -j DROP

To block an entire CIDR range:

iptables -A INPUT -s 1.2.3.0/24 -j DROP

Additional Security Best Practices

A firewall is necessary but not sufficient on its own. Pair it with these measures:

• Change the SSH port (from 22 to a high number like 2222 or 22000). This dramatically reduces automated brute-force attempts.
• Disable SSH password login and use only public-key authentication (PasswordAuthentication no in /etc/ssh/sshd_config).
• Install fail2ban to ban IPs that accumulate failed login attempts.
• Close MySQL to the outside (bind-address = 127.0.0.1 in MariaDB config) and block port 3306 in the firewall.
• Keep the kernel and packages updated; many actively exploited vulnerabilities have patches available days before mass attacks begin.

For a broader look at VPS server security, browse our VPS server guide section covering hardening, monitoring, and more.

For projects where security is critical and you don't have an in-house DevOps team, elenlace.com can configure and maintain your VPS firewall as part of an ongoing managed service.

Key Takeaways

• Every Linux VPS needs an active firewall from minute one; without it, the server is exposed to scanners and automated attacks around the clock.
• UFW is the simplest option for Ubuntu/Debian: set deny-by-default, allow SSH and your service ports, then enable it.
• iptables offers greater control for advanced setups, but you must save rules manually for them to survive reboots.
• A network firewall is just one layer: combine it with fail2ban, SSH key authentication, and frequent system updates.
• Never enable the firewall without first confirming the SSH port is allowed — otherwise you'll lock yourself out of your own server.

FAQ

Can I use UFW and iptables at the same time?

It's not recommended. UFW generates iptables rules internally; if you also modify iptables directly, the rules can conflict. Choose one tool and use it exclusively, or migrate to nftables, which replaces both on modern distributions.

Does my VPS provider already include a firewall?

Many providers offer a perimeter firewall in their control panel (separate from the OS-level firewall). Both layers are useful and complementary: the provider's firewall acts before traffic reaches the server; the OS firewall is the last barrier inside the VPS. Enable both.

Do I need to open different ports for a mail server?

Yes. A full mail server requires ports 25 (server-to-server SMTP), 587 (authenticated SMTP), 993 (IMAP over TLS), and optionally 465 (SMTPS). Open only the ports your configuration actually uses, and consider blocking inbound port 25 if you only send and don't receive mail on the same server.

How do I check which ports are open on my VPS?

From inside the server: ss -tlnp shows listening ports with the associated process. From outside the server, a tool like nmap -sV <VPS IP> shows the ports visible from the internet — exactly what an attacker would see.

Prefer it done for you? El Enlace handles hosting and professional web development.

Further reading

Other providers and guides worth comparing:

• HostGator México
• Hostinger
• HubSpot