How to Configure Your VPS Firewall: UFW and iptables

Introduction

The firewall is the first line of defense for your VPS. It controls which connections enter and leave the server: what isn’t explicitly allowed is rejected. Without an active firewall, your server is exposed to any internet connection.

In this article you’ll see how to configure your VPS firewall with the most common tools: UFW (Ubuntu and Debian), firewalld (AlmaLinux and Rocky Linux) and iptables (for advanced cases).

What a firewall is and why you need it

A firewall is like a bouncer that decides who can enter your server and through which door (port). It works with simple rules:

• Allow connections to certain ports (SSH, web, email).
• Deny the rest.

Without a firewall, any service installed on your server is accessible from the internet. With a firewall, only what you decide.

[Imagen sugerida: diagram of a firewall allowing only SSH, HTTP and HTTPS]

The firewall is so important that most VPS have it enabled by default. But it’s worth reviewing and customizing the rules.

Which ports you need to open

Before configuring anything, be clear about which ports you’ll need:

The golden rule: open only what you need. The fewer open ports, the more secure.

Configure UFW (Ubuntu and Debian)

UFW (Uncomplicated Firewall) is the easiest firewall to use. It’s included in Ubuntu and Debian.

Step 1: Define default policies

The safest approach is to deny all incoming traffic and allow all outgoing:

ufw default deny incoming
ufw default allow outgoing

Step 2: Open the SSH port (before enabling it!)

If you don’t open the SSH port before enabling the firewall, you’ll be locked out of the server.

ufw allow 22/tcp

If you changed the SSH port (for example to 2222), open that one:

ufw allow 2222/tcp

Step 3: Open web ports

ufw allow 80/tcp
ufw allow 443/tcp

Step 4: Open additional ports if needed

For example, for a control panel:

ufw allow 8090/tcp

Step 5: Enable the firewall

ufw enable

It will ask for confirmation. Type y and press Enter.

Step 6: Check the status

ufw status verbose

You’ll see the list of active rules.

[Imagen sugerida: screenshot of the ufw status command showing the rules]

Configure firewalld (AlmaLinux, Rocky Linux, CentOS)

Firewalld is the firewall that comes in Red Hat-based distributions.

Step 1: Verify it’s active

systemctl status firewalld

If it’s not active, start it:

systemctl start firewalld
systemctl enable firewalld

Step 2: Open the necessary ports

firewall-cmd --permanent --add-port=22/tcp
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https

If you changed the SSH port, open that one instead of 22.

Step 3: Apply the changes

firewall-cmd --reload

Step 4: Check the rules

firewall-cmd --list-all

Configure iptables (advanced)

iptables is Linux’s oldest and most powerful firewall, but its syntax is more complex. UFW and firewalld use it underneath.

If you need to use iptables directly (rare case today):

View current rules

iptables -L -n -v

Open the SSH port

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Open web ports

iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Save the rules

To persist them across reboots:

apt install iptables-persistent -y
netfilter-persistent save

iptables is powerful but easy to misconfigure. If you have no experience, use UFW or firewalld.

Useful tips

• Open the SSH port before enabling the firewall. If not, you’ll be locked out.
• Open only what you need. The fewer ports, the more secure.
• Don’t open the database port (3306) to the internet. If you need remote access, restrict by IP.
• Review the rules periodically. You may have opened ports you no longer need.
• Combine the firewall with fail2ban. The firewall controls connections; fail2ban blocks malicious IPs.

Common problems

I got locked out of the server after enabling the firewall

You forgot to open the SSH port. Use the VPS panel’s recovery console to log in and open it, or contact support.

A website doesn’t load after enabling the firewall

You probably didn’t open port 80 or 443. Add them with ufw allow 80/tcp and ufw allow 443/tcp.

I don’t know which ports are open

Check with ufw status (UFW) or firewall-cmd --list-all (firewalld). You can also see which services are listening with ss -tulpn.

The firewall is very slow

A properly configured firewall doesn’t affect performance. If you notice slowness, you may have thousands of rules or a configuration error.

I configured a rule wrong and everything fails

You can reset the firewall:

ufw reset

Careful: this deletes all rules. You’ll have to reopen them (start with SSH).

Frequently asked questions

UFW, firewalld or iptables?

For beginners, UFW (Ubuntu/Debian) or firewalld (AlmaLinux/Rocky). iptables only for advanced cases.

Does the firewall affect my website’s speed?

No, if properly configured. Rule processing is almost instantaneous.

Can I block an entire country?

Yes, with additional tools like ipset or firewalld extensions. But it’s usually not necessary if you configure fail2ban well.

Do I need a firewall if I have a control panel?

Yes. Panels usually automatically open the ports they need, but it’s worth reviewing and securing the ones you don’t use.

Does the firewall protect against web attacks (like SQL injection)?

Not directly. For that you need a WAF (Web Application Firewall) like ModSecurity or Wordfence. The network firewall controls connections, not the content of requests.

Your VPS, protected with a good firewall

A well-configured firewall is the foundation of your VPS security. Open only the ports you need (SSH, web and email if applicable), deny the rest and combine with fail2ban for solid protection.

If you have a miHosting managed VPS, we configure and maintain the firewall for you. If you have a self-managed VPS, this guide serves to protect it from day one. Open a ticket from your client panel if you need help.