A fresh VPS accepts connections on every port where a service is listening. Before you host anything, set up a default-deny firewall, so only the ports you choose are open.
1. Understand default deny
The firewall blocks all incoming traffic by default, and you allow only what you need (SSH, web). Outgoing traffic stays open so the server can download updates. Every step below follows this model.
Ubuntu, Debian, and other Debian-based distros use ufw. AlmaLinux, Rocky Linux, RHEL, and other RHEL-based distros ship firewalld. Both are tools for the same kernel packet filter. Pick the section for your distro family.
2. Install the firewall tool
$ sudo apt update && sudo apt install -y ufw$ sudo dnf install -y firewalld $ sudo systemctl enable --now firewalld
firewalld starts blocking right away, but its default zone already allows SSH, so you will not lose your connection. ufw stays off until you enable it.
3. Allow SSH before anything else
If you enable a default-deny firewall without an SSH rule, your current session may stay open, but every new login will be blocked.
$ sudo ufw allow OpenSSH$ sudo firewall-cmd --permanent --add-service=sshCustom SSH port
If sshd listens on a different port, allow that port instead: sudo ufw allow 2222/tcp or sudo firewall-cmd --permanent --add-port=2222/tcp. Verify with sudo ss -tlnp | grep sshd before enabling the firewall.
4. Enable the firewall
$ sudo ufw default deny incoming $ sudo ufw default allow outgoing $ sudo ufw enable
ufw warns that enabling it may break existing SSH connections. You already added the SSH rule in step 3, so it is safe to confirm with y.
$ sudo firewall-cmd --reloadOn RHEL-based distros the firewall is already running from step 2. The reload applies your permanent rules to the live configuration.
5. Open web ports
Do this only if the server will host a website or a reverse proxy. Port 80 is HTTP, and port 443 is HTTPS.
$ sudo ufw allow 80/tcp $ sudo ufw allow 443/tcp
$ sudo firewall-cmd --permanent --add-service=http $ sudo firewall-cmd --permanent --add-service=https $ sudo firewall-cmd --reload
6. Check what is allowed
$ sudo ufw status verbose$ sudo firewall-cmd --list-allCompare the output with what you want to be public. If you see a rule you do not recognize, remove it before you continue.
7. Add a port later
When you install a new service later (for example a mail server on port 25, or a game server on port 27015), open its port the same way.
$ sudo ufw allow 25/tcp$ sudo firewall-cmd --permanent --add-port=25/tcp $ sudo firewall-cmd --reload
To remove a rule: sudo ufw delete allow 25/tcp or sudo firewall-cmd --permanent --remove-port=25/tcp followed by a reload.
Permanent vs runtime on firewalld
--permanent writes the rule to disk but does not apply it until you reload. Without --permanent the rule applies instantly but disappears on reboot. You can use both on purpose: test a rule live first, then make it permanent.
8. IPv6 is covered automatically
Every D4 Networks VPS comes with a dedicated IPv6 /64, so your firewall has to cover both address families. Both tools already do: ufw duplicates every rule for IPv6 as long as IPV6=yes is set in /etc/default/ufw (the default on Ubuntu and Debian), and firewalld zone rules apply to IPv4 and IPv6 alike. Confirm with the step 6 commands: ufw status shows a (v6) entry next to each rule.
Do not block ICMPv6 wholesale. IPv6 relies on it for neighbor discovery and path MTU, and both tools leave it allowed by default. Keep it that way.
Quick reference
| Task | Ubuntu and Debian (ufw) | RHEL-based (firewalld) |
|---|---|---|
| Allow SSH | ufw allow OpenSSH | firewall-cmd --permanent --add-service=ssh |
| Open a port | ufw allow 443/tcp | firewall-cmd --permanent --add-port=443/tcp |
| Apply changes | immediate | firewall-cmd --reload |
| Show rules | ufw status verbose | firewall-cmd --list-all |
| Remove a rule | ufw delete allow 443/tcp | firewall-cmd --permanent --remove-port=443/tcp |
Where to go next
Next, secure SSH itself: turn off password login and use keys, and add fail2ban to block repeated login attempts. DDoS protection is included on all D4 Networks plans.