> ## Documentation Index
> Fetch the complete documentation index at: https://kb.hostcloud.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a firewall on your VPS

> Block unwanted connections to your Linux VPS with UFW.

A firewall blocks every connection to your server except the ones you allow. This guide shows you how to set one up with UFW, a simple firewall for Ubuntu and Debian.

> [!WARNING]
>
> Always allow SSH **before** you turn the firewall on, or you'll lock yourself out. If that happens, use the browser console to fix it. See [Use the browser console and rescue mode](/vps/console-and-rescue-mode.md).

## Set up UFW

First, [connect to your VPS with SSH](/vps/access-your-vps-over-ssh.md).

**1. Install UFW**

```bash theme={null}
sudo apt update && sudo apt install ufw -y
```

**2. Block incoming, allow outgoing**

```bash theme={null}
sudo ufw default deny incoming
sudo ufw default allow outgoing
```

**3. Allow SSH**

```bash theme={null}
sudo ufw allow OpenSSH
```

If you changed your SSH port, allow that port instead, for example `sudo ufw allow 2222/tcp`.

**4. Allow what your server needs**

For a website:

```bash theme={null}
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
```

**5. Turn it on**

```bash theme={null}
sudo ufw enable
```

Type `y` to confirm.

## Manage rules

| To do this | Run |
| - | - |
| See the firewall status and rules | `sudo ufw status numbered` |
| Allow a port | `sudo ufw allow 3306/tcp` |
| Allow a port only from one IP address | `sudo ufw allow from 198.51.100.7 to any port 3306` |
| Delete a rule | `sudo ufw delete 3` (use the number from `status numbered`) |
| Turn the firewall off | `sudo ufw disable` |

> [!TIP]
>
> Only open ports you actually use. For example, don't open a database port (such as `3306`) to everyone. Allow it only from the IP addresses that need it.

## AlmaLinux, Rocky Linux or Fedora?

These use `firewalld` instead of UFW:

```bash theme={null}
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
```

## Firewall tab in the Client Area

You can also attach a firewall from the **Firewall** tab on your server panel. It filters traffic before it reaches your server, and one firewall can protect several of your servers at once. If you use it as well as UFW, a connection must be allowed by both.

![The Firewall tab on the VPS server panel, showing that no firewall is attached yet](https://mintcdn.com/host-cloud/RZlILv_TrgPxefdL/images/vps/firewall-tab.jpg?fit=max\&auto=format\&n=RZlILv_TrgPxefdL\&q=85\&s=a73e7cfff660cf9bcda65c77107b067b)

Still stuck? [Open a ticket](/support/open-a-ticket.md) with your server's IP address.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.