Packet filtering · Intermediate · 20 minutes, verified externally
How to set up a firewall with ufw — The Allow List Is the Attack Surface. Keep It Short Enough to Read
One command away from a default-deny firewall, and one command away from locking yourself out of the machine you are typing it on.
The short answer
Allow SSH before you enable anything, because a default-deny policy applies to the session you are typing in. That single ordering mistake is the most common way a VPS becomes unreachable, and it is entirely avoidable: add the rule, print the status to confirm it is there, then enable the firewall.
After that, the goal is a rule list short enough to read in one glance — SSH, 80 and 443 for a web server, and nothing else without a reason. Anything administrative gets scoped to a source address rather than opened to the internet, and every rule gets verified from a machine that is not this one, because rules that look right locally still need proving from outside.
By the HostingFast team · Reviewed 24 August 2026
Intermediate
Level assumed
5
Stages start to finish
Free
What support costs
Proven
Measured on our own stack
Twenty minutes, and the last five of them are the verification most guides leave out. Assumed: you have a second device or a second network to test from, because testing a firewall from inside the machine it protects proves nothing at all.
The output you want is the verbose status listing. It is the complete, readable statement of how anything reaches this machine, and if it is too long to take in at a glance, that is the finding rather than the format.
The ordering that keeps you connected
Permit OpenSSH — or the port number if you moved it — before the firewall is enabled. Print the status and see the rule in the list. Only then enable. Get this backwards and the connection drops mid-command while the server carries on cheerfully blocking you, and your next step is a provider rescue console.
Keep the existing session open throughout, exactly as you would when changing SSH settings. An open shell is a working escape hatch; a closed one is a support ticket. This is the same discipline as the key-before-passwords rule, applied to a different door.
Default deny, then a list you can read
Deny incoming, allow outgoing. Inbound becomes a short explicit list; outbound stays open so package updates and API calls keep working. From that point, everything reachable is something you deliberately allowed, which is a much better position than trying to remember what you once installed.
For a web server that list is SSH, 80 and 443. Database ports, admin panels and management interfaces do not belong on it: bind those services to localhost, or reach them through an SSH tunnel, which costs you nothing extra and removes the port from the internet entirely.
Scope by source, and rate-limit the door you left open
When something genuinely needs remote access, allow it from a specific source address rather than from everywhere. That is the difference between a considered exception and an open door, and it keeps the rule self-documenting — anyone reading the list later can see who it was for.
ufw limit on SSH adds simple rate limiting, dropping connections from an address making repeated attempts in a short window. It is not a substitute for keys-only authentication; it is what keeps the noise down alongside it, which in practice means an auth log you can still read.
Verify from somewhere that is not this machine
Reconnect over SSH from a second terminal, then scan the host from another machine entirely — or simply load the site from a phone with wifi off. A port you believe is closed and a port that is actually closed are two different claims, and only the external test settles which one you have.
One more thing worth knowing: container runtimes frequently write their own rules directly into the kernel's tables, which can publish a container port past the policy you configured here. If the box runs containers, check the external scan again after starting them, because the status output will not mention it.
The filtering that happens before this
On our platform, DDoS filtering is absorbed out at the network edge before traffic reaches the account at all, and the shared plans run Imunify360 with account isolation on top. A host-level firewall is the layer you own on a VPS; on shared hosting it is already somebody else's shift.
Free SSL on every plan, reissued automatically before it can expire — because port 443 being open is only half the job.
- DDoS filtering absorbed at the network edge
- Imunify360 and account isolation on the shared platform
- Free auto-renewing SSL behind the port you just opened
- Engineers on shift if a rule locks you out at an awkward hour
Why HostingFast
Standard on every plan
The lockout designed out
SSH allowed and confirmed in the status output before the firewall is enabled, with the working session kept open throughout.
A readable rule list
Default deny plus a handful of explicit allows means the complete set of ways in fits on one screen.
Exceptions with a source
Administrative access scoped to a specific address, or tunnelled over SSH, rather than opened to the whole internet.
Rate limiting in its place
ufw limit is presented as noise control alongside key authentication, not as a replacement for it.
Proved from outside
A scan from another machine, or the site loaded from a phone off your network, because local checks prove nothing.
The container caveat
Container runtimes can publish ports past your policy, and the status output will never mention that it happened.
Quick Start
From order to online
- 1
Allow SSH and confirm it in the status
Permit OpenSSH or your custom port, print the rule list, and see it there. This happens before the firewall is enabled, every single time.
- 2
Set default deny in, allow out
Inbound becomes a short explicit list; outbound stays open so updates and API calls keep working normally.
- 3
Open only what the server serves
80 and 443 for a web server. Databases and admin interfaces stay on localhost or behind an SSH tunnel rather than on the allow list.
- 4
Scope and rate-limit what remains
Source-restrict any administrative exception to a specific address, and apply ufw limit to SSH so repeated guessing gets dropped.
- 5
Verify from another machine
Scan the host from elsewhere and load the site from a phone with wifi off. If containers are running, repeat the scan after they start.
Built In
Loaded onto every plan
- DDoS filtering absorbed out at the network edge
- SSH, Git and Composer on the developer-focused plans
- Free SSL on every plan, reissued automatically before it can expire
- NVMe SSD storage on every tier, including the entry plan
- 99.9% uptime as the target, monitored around the clock
- Daily backups on every plan, with restores you run yourself from the panel
- cPanel — the control panel most of the industry already runs
- Per-site PHP version switching from the control panel
- In-place account upgrades, with no migration when you change plan
- Human support on duty every hour of every day
Frequently Asked
What people ask us most often
Does packet filtering add measurable latency?
Not at any traffic level a single web server sees. The rule set is evaluated in the kernel and a short list costs microseconds, which is invisible next to a network round trip. If a machine slows down after enabling a firewall, look for a rule causing DNS lookups or reverse lookups rather than blaming the filtering itself.
How do I verify a port is genuinely closed from outside?
Scan the host from a different machine on a different network, or at minimum load the service from a phone with wifi turned off. Checking from the server itself tests the loopback path and proves nothing about what the internet can reach. Re-run the external check after any change, including after starting containers.
What does ufw limit actually do?
It drops new connections from a source address that has made several attempts within a short window, which takes the edge off automated password guessing against SSH. Treat it as noise reduction rather than protection: keys-only authentication is what makes guessing pointless, and the rate limit is what keeps your auth log readable while they try.
Do container runtimes bypass UFW rules?
They can, and it surprises people. Some runtimes write rules directly into the kernel's tables when publishing a port, which can expose a container service past the policy you configured — and the firewall's own status output will show no sign of it. Publish container ports to 127.0.0.1 where you can, and always re-run an external scan after starting containers.
Keep reading
How to Connect a CDN
Measure the round trip from your audience's region, then decide whether an edge earns its place — intermediate, roughly an hour.
How to Add an Addon Domain
Run a second site in the same account with its own document root and clean separation — beginner, roughly 10 minutes.
WAF (Web Application Firewall) (Glossary)
What an application firewall inspects, where it sits in the request path, and how it differs from packet filtering.
Web Hosting
cPanel hosting on NVMe behind a LiteSpeed cache — SSL, migration and a year-one domain included.
Secure Hosting
Imunify360, account isolation and hardened defaults for security-first builds.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Let the edge absorb the noise.
DDoS filtering at the network edge, Imunify360 and account isolation on shared plans, and root-access KVM servers when you want the rules yourself.
View Web Hosting plans