Set up a firewall on your VPS with UFW
A fresh VPS answers on every port that has a program listening. A firewall lets you close everything except what you actually use. On Ubuntu and Debian the easiest way is UFW, short for Uncomplicated Firewall, and the whole setup takes about five minutes.
The one thing to be careful about: allow SSH before you turn the firewall on. If you enable it first, you lock yourself out of your own server.
Install and set the defaults
UFW is already installed on most Ubuntu images. If not, sudo apt install ufw adds it. Then set the baseline: block everything coming in, allow everything going out.
sudo ufw default deny incoming
sudo ufw default allow outgoing
Open the ports you need
SSH first, always:
sudo ufw allow OpenSSH
If you moved SSH to a different port, allow that port number instead, for example sudo ufw allow 2222/tcp. Then add whatever your server really runs. For a website:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
For a game server, allow the port from your server page, using /tcp, /udp or both depending on the game. Open only what you can name a reason for.
Turn it on and check
sudo ufw enable
sudo ufw status verbose
UFW warns that it may disrupt SSH connections. Since you allowed SSH in the step above, say yes. Keep your current session open and, before you close it, start a second SSH session to confirm you can still get in. If that works, you're set.
Everyday tasks
- See rules with numbers:
sudo ufw status numbered - Delete a rule:
sudo ufw delete 3(use the number from the list above) - Slow down brute-force login attempts:
sudo ufw limit 22/tcpinstead of a plain allow. It blocks an address that opens too many connections in a short time.
Two things that catch people out
Docker ignores UFW for the ports it publishes. If you run containers with -p 8080:80, Docker adds its own rules, and that port is open to the world even though UFW says it's closed. Bind to localhost with -p 127.0.0.1:8080:80 for anything that shouldn't be public.
UFW protects the VPS itself, nothing more. If your plan has a separate firewall in front of the server, that one has its own rules.
If you do lock yourself out
Don't panic, and don't keep retrying SSH. Use the console access from your dashboard if your plan includes it, run sudo ufw disable, and redo the rules. If you can't reach the server at all, open a ticket and say what you changed.
For the rest of the basics, see Basic security for a new VPS. If you're new to connecting, start with Connect to your VPS over SSH.
Still stuck? Open a ticket on Discord - run /ticket in any channel, pick a department, and include your Server ID or Invoice ID so we can jump straight in.