ChatGPT, Claude, Gemini, Grok — all four for $20.00/mo

0
View Pricing

Self-Managed VPS and VDS: Setting Up and Managing the Firewall

Home 
 
/
 Self-Managed VPS and VDS: Setting Up and Managing the Firewall

A firewall helps protect your Bluehost Self-Managed VPS or Virtual Dedicated Server (VDS) from unauthorized access. This guide shows how to set up, enable, and manage the three most common Linux firewalls (firewalld, ufw, and iptables) on AlmaLinux, Rocky Linux, CentOS Stream, Ubuntu, Debian, and Fedora. It covers opening and closing ports, checking status, and basic troubleshooting.

Tip: Looking for a full security checklist?

See Bluehost Self-Managed VPS: How to Secure Your Server After Setup for a complete guide to hardening your new Self-Managed VPS or VDS, including passwords, users, firewall, SSH, and updates.

Which Firewall Should I Use?

  • firewalld is the standard firewall tool for AlmaLinux, Rocky Linux, CentOS Stream, and Fedora.
  • ufw (Uncomplicated Firewall) is the simplest option for Ubuntu and Debian. It's typically preinstalled but turned off on Ubuntu, and you install it on Debian.
  • iptables is for advanced, manual setups. It works on all of these distributions, but you may need to install it first.
  • Use only one firewall tool at a time to avoid conflicts and confusion.

Setting Up firewalld (AlmaLinux, Rocky Linux, CentOS Stream, Fedora)

Run the commands below over SSH. If you're logged in as root, you can leave off sudo.

1. Install and Start firewalld

sudo dnf install firewalld -y sudo systemctl enable --now firewalld

Example Output:

Created symlink /etc/systemd/system/multi-user.target.wants/firewalld.service → /usr/lib/systemd/system/firewalld.service.

If firewalld was already enabled on your server, this line may not appear.

2. Check the Firewall Status

sudo firewall-cmd --state

Example Output:

running

3. Allow Essential Services (SSH, HTTP, HTTPS)

These commands allow SSH on port 22 and web traffic on ports 80 and 443. If you changed your SSH port, allow that port instead (see step 6).

sudo firewall-cmd --permanent --add-service=ssh sudo firewall-cmd --permanent --add-service=http sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --reload

Example Output:

success success success success

4. List Open Ports and Services

sudo firewall-cmd --list-all

Example Output:

public (active) target: default interfaces: eth0 services: cockpit dhcpv6-client http https ssh ports: ...

The services and interface name on your server may differ.

5. Remove a Service or Port

This example removes the ftp service, if you previously allowed it:

sudo firewall-cmd --permanent --remove-service=ftp sudo firewall-cmd --reload

6. Open a Custom Port

This example opens port 8080:

sudo firewall-cmd --permanent --add-port=8080/tcp sudo firewall-cmd --reload

Setting Up ufw (Ubuntu, Debian)

Run the commands below over SSH. If you're logged in as root, you can leave off sudo.

Some one-click application templates, such as GatorClaw, come with ufw already enabled and allow the ports the app needs, such as port 47716 for the GatorClaw web interface. If your server was set up from a template, check your existing rules first, and don't remove the rules your app depends on:

sudo ufw status verbose

1. Install ufw

sudo apt update sudo apt install ufw -y

Example Output:

Setting up ufw ...

If ufw is already installed, apt tells you it's already the newest version.

2. Allow Essential Ports Before Enabling ufw

Important: Allow SSH before you turn on ufw. Otherwise, you may lock yourself out of your server.

sudo ufw allow ssh sudo ufw allow http sudo ufw allow https

Example Output:

Rule added Rule added (v6) ...

3. Enable the Firewall

sudo ufw enable

Example Output:

Command may disrupt existing ssh connections. Proceed with operation (y|n)? y Firewall is active and enabled on system startup

4. Check the Firewall Status

sudo ufw status verbose

Example Output:

Status: active Logging: on (low) Default: deny (incoming), allow (outgoing), disabled (routed) New profiles: skip To Action From -- ------ ---- 22/tcp ALLOW IN Anywhere 80/tcp ALLOW IN Anywhere 443/tcp ALLOW IN Anywhere 22/tcp (v6) ALLOW IN Anywhere (v6) ...

5. Remove a Rule or Block a Port

This example removes an ftp allow rule and blocks port 3306:

sudo ufw delete allow ftp sudo ufw deny 3306

6. Allow a Custom Port

This example allows port 8080:

sudo ufw allow 8080/tcp

Setting Up iptables (Advanced)

iptables is the classic Linux firewall tool. Use it for custom, scriptable, or persistent rules on any of the supported distributions. You may need to install the iptables package first.

Warning:

  • It's easy to lock yourself out. Keep a second SSH session open while you make changes, and review your current rules before you start.
  • iptables rules you haven't saved are cleared when the server restarts.
  • iptables only applies to IPv4 traffic. Use ip6tables with the same options for IPv6.

Before you use iptables, turn off firewalld or ufw if either one is enabled:

AlmaLinux, Rocky Linux, CentOS Stream, Fedora:

sudo systemctl disable --now firewalld

Ubuntu, Debian:

sudo ufw disable

1. View Current Rules

sudo iptables -L -n -v

Example Output:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 10 600 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 5 380 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 ...

2. Allow Local and Established Connections

These rules keep your server's own traffic and replies to connections it starts, such as DNS lookups and package downloads, working once you drop other incoming traffic in step 5.

sudo iptables -A INPUT -i lo -j ACCEPT sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

3. Allow SSH, HTTP, and HTTPS

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

4. Block a Specific Port

This example blocks port 3306. The -I option inserts the rule at the top of the list so it takes effect before your other rules.

sudo iptables -I INPUT -p tcp --dport 3306 -j DROP

5. Drop All Other Incoming Traffic

Important: Run this only after the rules in steps 2 and 3 are in place, and confirm that your SSH rule is listed. Then test that you can open a new SSH session before you close your current one.

sudo iptables -A INPUT -j DROP

6. Save Rules Across Restarts

Ubuntu, Debian:

sudo apt install iptables-persistent -y sudo netfilter-persistent save

During installation, you may be asked whether to save your current rules. Choose Yes.

AlmaLinux, Rocky Linux, CentOS Stream, Fedora:

sudo dnf install iptables-services -y sudo iptables-save | sudo tee /etc/sysconfig/iptables sudo systemctl enable --now iptables

Save your rules before you start the iptables service. Otherwise, the service loads its default rules instead of yours.

7. Remove a Rule

This example removes the port 3306 rule from step 4:

sudo iptables -D INPUT -p tcp --dport 3306 -j DROP

Save your rules again afterward so the change persists after a restart.

Common Firewall Commands Table

firewalld commands start with sudo firewall-cmd (add --permanent when adding or removing rules). ufw commands start with sudo ufw, and iptables commands start with sudo iptables.

Common actions and the matching firewalld, ufw, and iptables commands
Action firewalld ufw iptables
Allow SSH --add-service=ssh allow ssh -A INPUT -p tcp --dport 22 -j ACCEPT
Allow HTTP and HTTPS --add-service=http,
--add-service=https		 allow http,
allow https		 -A INPUT -p tcp --dport 80 -j ACCEPT,
-A INPUT -p tcp --dport 443 -j ACCEPT
Close or block a port --remove-port=PORT/tcp deny PORT -I INPUT -p tcp --dport PORT -j DROP
Open custom port 8080/tcp --add-port=8080/tcp allow 8080/tcp -A INPUT -p tcp --dport 8080 -j ACCEPT
List rules and status --list-all status verbose -L -n -v
Apply or save changes --reload enable (first time) netfilter-persistent save (Ubuntu, Debian)

Troubleshooting and Tips

  • If you lose access, use the Console for your server in your Bluehost Portal to reset or disable your firewall rules.
  • Make sure your SSH port stays open (port 22 by default), or you may lock yourself out.
  • Only one firewall tool (firewalld, ufw, or iptables) should be active. Disable any others to avoid conflicts.
  • After changing rules, test access from another terminal before you log out.
  • To check which ports are visible from outside your server, run an open port scan. See the Network and Open Port Scan section of Bluehost Self-Managed VPS and VDS: How to Scan for Vulnerabilities and Malware.
  • If you run Docker containers, keep in mind that Docker adds its own firewall rules for the ports it publishes. A ufw or firewalld rule may not block a port that a container publishes. To change which ports a container exposes, change the container's port settings.
  • Review all active rules with the command for your firewall tool:

firewalld:

sudo firewall-cmd --list-all

ufw:

sudo ufw status verbose

iptables:

sudo iptables -L -n -v

Summary

A properly configured firewall is an important part of keeping your Bluehost Self-Managed VPS or Virtual Dedicated Server (VDS) secure. firewalld (AlmaLinux, Rocky Linux, CentOS Stream, Fedora) or ufw (Ubuntu, Debian) works well for most cases, and iptables is available when you need something more complex. Remember to test your rules, keep your SSH port open, and use the Console if you get locked out.