How to Set Up and Configure Firewall on Linux VPS

Controlling network traffic entering and leaving your Linux Virtual Private Server (VPS) is the primary foundation of server security. A properly configured firewall blocks unauthorized port scans, restricts malicious connection attempts, and ensures only designated public services (such as SSH, HTTP, and HTTPS) can be reached from the Internet.

Linux distributions primarily use one of two standard firewall management tools:

• UFW (Uncomplicated Firewall): The standard firewall for Ubuntu & Debian.
• Firewalld: The dynamic zone-based firewall manager for AlmaLinux, Rocky Linux, RHEL, and CentOS Stream.

In this comprehensive guide, we will walk you through configuring both UFW and Firewalld on your Aveshost Linux VPS, opening essential ports, setting up custom rules, and safely activating your firewall without getting locked out.

Prerequisites

• An active Linux VPS running Ubuntu, Debian, AlmaLinux, Rocky Linux, or CentOS.
• SSH root or sudo access (see How to Log in and Access Linux VPS via SSH).

Part 1: Configuring UFW (Ubuntu & Debian)

Step 1: Check Status and Set Default Policies

# Deny all incoming connections and allow all outgoing connections
sudo ufw default deny incoming
sudo ufw default allow outgoing

Step 2: Allow Essential Ports (CRITICAL: Allow SSH First)

# Allow SSH
sudo ufw allow OpenSSH
# OR: sudo ufw allow 22/tcp

# Allow Web Traffic (HTTP and HTTPS)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
# OR for Nginx: sudo ufw allow 'Nginx Full'

# Allow Custom Port (e.g. Node.js App on port 3000)
sudo ufw allow 3000/tcp

Step 3: Enable UFW and Verify Status

# Enable UFW (type 'y' when prompted)
sudo ufw enable

# Check numbered rule list
sudo ufw status numbered

Part 2: Configuring Firewalld (AlmaLinux, Rocky Linux & RHEL)

Step 1: Start and Enable Firewalld

sudo systemctl enable firewalld
sudo systemctl start firewalld
sudo firewall-cmd --state

Step 2: Allow Essential Services and Ports

Firewalld uses zones (the default is the public zone). Use the --permanent flag to persist rules across reboots:

# Ensure SSH is allowed
sudo firewall-cmd --permanent --add-service=ssh

# Allow HTTP and HTTPS web traffic
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https

# Allow a specific custom port (e.g., 3000/tcp or 8080/tcp)
sudo firewall-cmd --permanent --add-port=3000/tcp

# Reload firewalld to apply changes
sudo firewall-cmd --reload

Step 3: Verify Active Firewalld Rules

sudo firewall-cmd --list-all

You will see a clean summary showing active services (ssh http https) and open ports.

Part 3: Advanced Firewall Rules

1. Restricting Port Access to a Specific IP Address:

• On UFW:

  sudo ufw allow from 203.0.113.50 to any port 3306 proto tcp

• On Firewalld:

  sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.50" port port="3306" protocol="tcp" accept' && sudo firewall-cmd --reload

2. Deleting Rules:

• On UFW: sudo ufw delete [rule_number] (check numbers with sudo ufw status numbered).
• On Firewalld: sudo firewall-cmd --permanent --remove-port=3000/tcp && sudo firewall-cmd --reload.

Frequently Asked Questions & Troubleshooting

Q: What should I do if I accidentally locked myself out?
A: Log in to the Aveshost Client Area, open your VPS management dashboard, and launch the VNC / Web Console to run sudo ufw allow 22/tcp or sudo systemctl stop firewalld.

Q: Does the firewall affect outbound API calls from my server?
A: No. Default outbound traffic is permitted on both UFW and Firewalld, allowing your server to download packages and call external APIs freely.

Need Further Assistance?

If you have questions about configuring firewall rules or securing your Linux VPS, our technical support team is available 24/7. Feel free to submit a support ticket for prompt assistance.