Security
How to Secure Your VPS with the UFW Firewall
UFW (Uncomplicated Firewall) is a friendly front end to the Linux netfilter firewall. This guide sets a default-deny policy and, critically, allows SSH BEFORE enabling the firewall so you do not lock yourself out. It also rate-limits SSH to slow down brute-force attempts.
Install UFW
UFW is preinstalled on Ubuntu but install it to be sure.
sudo apt update sudo apt install -y ufw
Set Default Policies
Deny all incoming traffic by default and allow outgoing. From here you explicitly open only the ports you need.
sudo ufw default deny incoming # block everything inbound unless explicitly allowed sudo ufw default allow outgoing # let the server reach out for updates, etc.
Allow SSH BEFORE Enabling (Critical)
If you enable the firewall without allowing SSH first, your current connection drops and you are locked out. Allow OpenSSH now. If your SSH runs on a custom port, allow that port number instead.
sudo ufw allow OpenSSH # opens port 22; use 'sudo ufw allow 2222/tcp' for a custom SSH port
Rate-Limit SSH
Replace the plain allow with a rate-limited rule. UFW will block an IP that makes 6 or more connections within 30 seconds, blunting brute-force attacks.
sudo ufw limit OpenSSH # rate-limit instead of plain allow to throttle repeated login attempts
Allow Any Other Services You Run
Open web ports only if you actually host a website. Skip this for a database-only or app-only box.
sudo ufw allow 80/tcp # HTTP (only if you serve web traffic) sudo ufw allow 443/tcp # HTTPS (only if you serve web traffic)
Enable UFW and Verify
Now that SSH is allowed and rate-limited, enable the firewall and review the active ruleset.
sudo ufw enable # confirm the prompt; your SSH session stays up because OpenSSH is allowed sudo ufw status verbose # confirm default deny incoming and your LIMIT/ALLOW rules sudo ufw status numbered # numbered list, handy for deleting a rule later
Your VPS now denies all inbound traffic except the services you explicitly opened, with SSH rate-limited against brute-force attacks. Always add an allow rule for a new service BEFORE the clients that need it connect, and double-check status verbose after any change.