Firewall Setup
Complete guide to configuring firewalls on your VPS. Learn UFW, firewalld, iptables, and best practices for securing your server.
- Root or sudo access to your VPS
- Basic understanding of networking concepts
- Knowledge of the services running on your server
- Backup of current firewall configuration (recommended)
A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It's one of the most important security layers for your VPS.
Why Firewalls Matter:
- Blocks unauthorized access to your server
- Controls which services are accessible
- Protects against network-based attacks
- Provides logging for security monitoring
- Essential for compliance and security standards
# Check current firewall status
sudo ufw status
sudo ufw status verbose
# Check firewalld status (if using firewalld)
sudo firewall-cmd --state
sudo firewall-cmd --list-allUFW (Uncomplicated Firewall) is the default firewall management tool for Ubuntu and Debian systems. It's designed to be easy to use while providing powerful functionality.
UFW Features:
- Simple command-line interface
- Easy rule management
- Application profiles
- IPv6 support
- Status monitoring
# Install UFW (if not already installed)
sudo apt update
sudo apt install ufw -y
# Enable UFW
sudo ufw enable
# Allow SSH (IMPORTANT: Do this first!)
sudo ufw allow ssh
sudo ufw allow 22
# Allow common services
sudo ufw allow 80/tcp # HTTP
sudo ufw allow 443/tcp # HTTPS
sudo ufw allow 3306/tcp # MySQL (if needed)
sudo ufw allow 5432/tcp # PostgreSQL (if needed)
# Allow specific port ranges
sudo ufw allow 3000:3100/tcp # Node.js apps
# Check status
sudo ufw status numberedFirewalld is the default firewall management tool for Red Hat-based distributions. It uses zones and services to manage firewall rules dynamically.
Firewalld Concepts:
- Zones - Predefined rule sets for different environments
- Services - Predefined service configurations
- Rich rules - Advanced rule syntax
- Runtime vs permanent - Immediate vs persistent changes
# Check firewalld status
sudo systemctl status firewalld
sudo systemctl enable firewalld
sudo systemctl start firewalld
# List all zones
sudo firewall-cmd --get-zones
# Get current active zone
sudo firewall-cmd --get-active-zones
# List services in current zone
sudo firewall-cmd --list-services
# Add services to public zone
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
# Add custom ports
sudo firewall-cmd --permanent --add-port=3000/tcp
# Reload firewall
sudo firewall-cmd --reload
# Check final configuration
sudo firewall-cmd --list-allBeyond basic service rules, you can create sophisticated firewall rules to meet specific security requirements and network architectures.
Advanced Rule Types:
- IP address restrictions
- Rate limiting
- Port knocking
- Time-based rules
- Connection tracking
# UFW: Allow from specific IP only
sudo ufw allow from 192.168.1.100 to any port 22
# UFW: Rate limiting
sudo ufw limit ssh
# UFW: Delete rules
sudo ufw status numbered
sudo ufw delete 2 # Delete rule number 2
# Firewalld: Rich rules
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.100" service name="ssh" accept'
# Firewalld: Port forwarding
sudo firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080
# Firewalld: Rate limiting
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" service name="ssh" accept limit value="10/m"Fail2Ban is an intrusion prevention software that works alongside your firewall to block brute-force attacks by dynamically updating firewall rules.
How Fail2Ban Works:
- Monitors log files for suspicious activity
- Detects failed login attempts
- Temporarily bans offending IP addresses
- Automatically unblocks after time expires
- Works with SSH, Apache, Nginx, and more
# Install Fail2Ban
sudo apt install fail2ban -y # Ubuntu/Debian
sudo dnf install fail2ban -y # CentOS/RHEL
# Start and enable Fail2Ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban
# Check status
sudo systemctl status fail2ban
# Check banned IPs
sudo fail2ban-client status sshd
# View Fail2Ban logs
sudo tail -f /var/log/fail2ban.log
# Custom jail configuration
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local
# Restart after configuration changes
sudo systemctl restart fail2banRegular monitoring of your firewall is essential for maintaining security. Learn how to monitor firewall activity and maintain your rules.
Monitoring Tasks:
- Regular rule audits
- Log analysis
- Performance monitoring
- Rule optimization
- Security testing
# Monitor firewall logs
sudo tail -f /var/log/ufw.log
sudo tail -f /var/log/firewalld
# Check for open ports
sudo netstat -tlnp
sudo ss -tlnp
# Test firewall rules (from another machine)
nmap -p 1-1000 your-server-ip
# Backup firewall rules
sudo iptables-save > firewall-backup.txt
sudo ufw status > ufw-backup.txt
# List all iptables rules
sudo iptables -L -n -v
# Check for unusual connections
sudo netstat -antp | grep ESTABLISHED
# Monitor bandwidth usage
sudo nload
sudo iftopCan't find what you're looking for? Our support team is here to help.