Skip to content
CitexNode
All guides

Set up a firewall

ufw on Debian and Ubuntu, firewalld on AlmaLinux and Rocky: allow SSH first, then the ports you need.

5 min read

On this page

Applies to Debian 12/13 and Ubuntu 22.04/24.04 with ufw, and to AlmaLinux 9 and Rocky Linux 9 with firewalld. Both handle IPv4 and IPv6 together.

The principle: all incoming traffic is blocked except what you explicitly allow. Outgoing traffic stays open.

Debian and Ubuntu: ufw

Install

bash
apt install -y ufw

Check IPv6

/etc/default/ufw must contain IPV6=yes (the default):

bash
grep IPV6 /etc/default/ufw

Every rule then automatically applies to your server's IPv6 address as well.

Allow SSH and enable

bash
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw enable

ufw enable warns that existing SSH connections may be interrupted. Since 22 is allowed, confirm with y.

Open more ports

bash
ufw allow 80/tcp          # HTTP
ufw allow 443/tcp         # HTTPS
ufw allow 25565/tcp       # Minecraft Java
ufw allow 19132/udp       # Minecraft Bedrock

Only for a specific address, such as your own:

bash
ufw allow from 198.51.100.7 to any port 3306 proto tcp

Remove a rule:

bash
ufw status numbered
ufw delete 4

Check

bash
ufw status verbose

You see Status: active, the default policies and every rule twice: once for IPv4 and once marked (v6).

AlmaLinux and Rocky Linux: firewalld

Install and start

Many images include firewalld already. Otherwise:

bash
dnf install -y firewalld
systemctl enable --now firewalld

The default zone public already allows SSH. Check before you go on:

bash
firewall-cmd --get-active-zones
firewall-cmd --list-all

ssh must appear under services:. If it's missing:

bash
firewall-cmd --permanent --add-service=ssh
firewall-cmd --reload

Open more ports

bash
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --permanent --add-port=25565/tcp
firewall-cmd --permanent --add-port=19132/udp
firewall-cmd --reload

Without --permanent, a rule only lasts until the next --reload or reboot. With --permanent, it only takes effect after --reload.

Only for a specific address:

bash
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="198.51.100.7" port port="3306" protocol="tcp" accept'
firewall-cmd --reload

To remove, use --remove-port, --remove-service or --remove-rich-rule with the same values.

Check

bash
firewall-cmd --list-all

firewalld filters IPv4 and IPv6 together; --add-port and --add-service apply to both.

Check from outside

From another computer (not the server itself), over IPv4 and IPv6:

bash
nmap -Pn 203.0.113.10
nmap -6 -Pn 2001:db8::10

Only what you allowed should be open. To check a single port quickly: nc -vz 203.0.113.10 25565.

Locked out?

If you can't get in via SSH after a rule change, your VPS's Console in the dashboard helps. It shows the server's screen in your browser and doesn't need SSH, see Console in the browser.

  1. Open the VPS in the dashboard, tab Console, Connect.

  2. Log in as root. The password is on the Overview under Credentials. Long password? Send it to the console with Paste text. If you don't know it any more: tab System, Reset root password.

  3. Allow SSH again:

    bash
    # ufw
ufw allow 22/tcp
# or turn the firewall off for now
ufw disable
    bash
    # firewalld
firewall-cmd --permanent --add-service=ssh
firewall-cmd --reload
# or stop it temporarily
systemctl stop firewalld

  4. Test via SSH, then turn the firewall back on properly.

Common errors

ProblemCause and fix
Port allowed, still unreachableThe program only listens on 127.0.0.1. ss -tlnp shows the address; for outside access it must say 0.0.0.0 or *.
Rule has no effect (firewalld)--permanent without --reload, or without --permanent and gone after a reboot.
ufw: command not found after installingYou're not root. Use sudo ufw ….
Outgoing mail doesn't arrivePorts 25, 465 and 587 are blocked outbound on VPS to prevent spam, regardless of your firewall. You can request unblocking in the Network tab under Mail ports, see Network.
Works over IPv6 but not IPv4 (or the other way round)ufw status shows whether the rule exists twice with (v6). Rules with a fixed source address only apply to that address family.

What next