Firewall rules that will not lock you out

Firewall rules that will not lock you out

You need fewer rules than you think. Allow SSH from where you administer the server, allow the application ports you actually use, and leave everything else closed. On AlmaLinux 9 that means using firewalld. On Ubuntu 24.04 that means using UFW.

This picks up from a server you can already reach over SSH.

Before you start

• On Hostworld VPSs, if you lock yourself out of SSH, you can regain access with the Virtualizor VNC console from the Hostworld client area. That does not rely on your firewall rules.
• Choose one firewall stack. On AlmaLinux 9 use firewalld or the raw nftables framework. Do not run multiple packet filters together. Mixing firewalld with the nftables service or old iptables tools causes unpredictable results.
• AlmaLinux 9 firewalld uses zones. The default zone is usually public. Interface to zone binding matters. Putting a public interface in a permissive zone such as trusted defeats filtering.
• Ubuntu 24.04 uses UFW by default. Its default policy is deny incoming, allow outgoing, deny routed. Enabling UFW over SSH shows a warning first.
• Changes in firewalld have runtime and permanent flavours. --permanent writes to disk but does not take effect until you reload. A normal --reload applies permanent settings to runtime and keeps state. A --complete-reload will likely drop active connections.
• UFW manages IPv6 only if IPV6=yes in /etc/default/ufw. One UFW rule then covers both IPv4 and IPv6.
• Docker can publish ports in ways that bypass UFW input filtering. Control exposures with the DOCKER-USER chain or integrate with firewalld and control forwarding. Plan for this before you go live.
• Setting UFW’s default outgoing to deny breaks updates and name lookups unless you add explicit egress allows. Most servers do not need to change the default outgoing policy.
• If you need help from us at any point, open a support ticket.

Step 1: Pick your firewall tool and baseline approach

Decide which commands you will use on this host, then stick with them.

• AlmaLinux 9: Use firewalld. Its backend is nftables by default. This guide uses firewalld commands. Do not run the separate nftables service alongside firewalld.
• Ubuntu 24.04: Use UFW. It manages both IPv4 and IPv6 when enabled.

The baseline approach is the same on both systems: add an SSH allow rule first, add only the ports your applications require, then enable or reload the firewall. Restrict SSH to your admin IPs if you can.

Step 2: Add the SSH allow rule first

Allowing SSH first prevents locking yourself out when you enable or tighten the firewall.

AlmaLinux 9 (firewalld)

This command allows SSH in the public zone permanently.

sudo firewall-cmd --permanent --zone=public --add-service=ssh

Ubuntu 24.04 (UFW)

This command allows SSH using UFW’s OpenSSH application profile.

sudo ufw allow OpenSSH

This alternative allows TCP port 22 explicitly.

sudo ufw allow 22/tcp

Step 3: Add web and any application ports you actually use

Add only what you run today. You can always add more later.

AlmaLinux 9 (firewalld)

These commands allow HTTP and HTTPS in the public zone permanently.

sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https

This command shows how to open a custom TCP port, for example 8080.

sudo firewall-cmd --permanent --zone=public --add-port=8080/tcp

Ubuntu 24.04 (UFW)

These commands allow HTTP and HTTPS.

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

This command shows how to open a custom TCP port, for example 8080.

sudo ufw allow 8080/tcp

Step 4: Apply the rules without dropping your SSH session

AlmaLinux 9 (firewalld)

This command applies permanent rules to the running firewall while keeping connection state.

sudo firewall-cmd --reload

Avoid a complete reload on a live system because it will likely terminate active connections. If you used --permanent earlier but forget to reload, the runtime will not reflect your changes.

Ubuntu 24.04 (UFW)

This command enables UFW with your current rules. If you run it over SSH, UFW warns you before proceeding.

sudo ufw enable

This command reloads UFW if it is already enabled or after editing its configuration files.

sudo ufw reload

Step 5: Restrict SSH to your admin IPs (recommended)

Limiting SSH to known source addresses reduces exposure. Keep a console open while testing. On Hostworld, the Virtualizor VNC console is available from the client area if you need to recover.

AlmaLinux 9 (firewalld)

This command adds a rich rule that allows SSH from one IPv4 address only. Replace 203.0.113.5 with your admin IP.

sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="203.0.113.5" service name="ssh" accept'

This command applies the change.

sudo firewall-cmd --reload

Once you confirm you can connect from that IP, you can remove the broad SSH allow. Do this in a maintenance window with console access available.

sudo firewall-cmd --permanent --zone=public --remove-service=ssh
sudo firewall-cmd --reload

Ubuntu 24.04 (UFW)

This command allows SSH from one IPv4 address only. Replace 203.0.113.5 with your admin IP.

sudo ufw allow from 203.0.113.5 to any port 22 proto tcp

This command rate limits new SSH connection attempts to reduce brute force noise.

sudo ufw limit ssh

Once you confirm you can connect from that IP, you can remove the broad SSH allow. Deleting by specification avoids rule renumbering mistakes.

sudo ufw delete allow OpenSSH
# or, if you used the port form:
sudo ufw delete allow 22/tcp

Step 6: If you run cPanel/WHM on your VPS, allow its ports

Only do this if you installed cPanel on your own VPS. Shared and reseller hosting with Hostworld already run behind our managed firewalls. For a cPanel server, you must allow its management and mail/web/DNS ports. The cPanel documentation is the authority for the full list. The commonly required SSL ports are 2083 for cPanel, 2087 for WHM, and 2096 for Webmail, plus standard web and mail ports 80, 443, 25, 465, 587, 110, 995, 143, 993, and DNS on 53.

AlmaLinux 9 (firewalld)

These commands allow the cPanel and WHM management ports.

sudo firewall-cmd --permanent --zone=public --add-port=2083/tcp
sudo firewall-cmd --permanent --zone=public --add-port=2087/tcp
sudo firewall-cmd --permanent --zone=public --add-port=2096/tcp

These commands allow standard web, mail and DNS ports.

sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --permanent --zone=public --add-port=25/tcp
sudo firewall-cmd --permanent --zone=public --add-port=465/tcp
sudo firewall-cmd --permanent --zone=public --add-port=587/tcp
sudo firewall-cmd --permanent --zone=public --add-port=110/tcp
sudo firewall-cmd --permanent --zone=public --add-port=995/tcp
sudo firewall-cmd --permanent --zone=public --add-port=143/tcp
sudo firewall-cmd --permanent --zone=public --add-port=993/tcp
sudo firewall-cmd --permanent --zone=public --add-port=53/tcp
sudo firewall-cmd --permanent --zone=public --add-port=53/udp
sudo firewall-cmd --reload

Ubuntu 24.04 (UFW)

These commands allow the cPanel and WHM management ports.

sudo ufw allow 2083/tcp
sudo ufw allow 2087/tcp
sudo ufw allow 2096/tcp

These commands allow standard web, mail and DNS ports.

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 25/tcp
sudo ufw allow 465/tcp
sudo ufw allow 587/tcp
sudo ufw allow 110/tcp
sudo ufw allow 995/tcp
sudo ufw allow 143/tcp
sudo ufw allow 993/tcp
sudo ufw allow 53/tcp
sudo ufw allow 53/udp

Step 7: Account for Docker and forwarded ports

When you publish a container port, Docker installs prerouting and forwarding rules that can bypass UFW’s input filtering. A service that you thought was blocked can become reachable. Control this in one of two ways.

• Use the DOCKER-USER chain to enforce your policy before Docker’s own rules. This applies on Ubuntu.
• On AlmaLinux with firewalld, use the firewalld integration and consider the StrictForwardPorts option. When set to yes, published ports are not implicitly accepted. You must allow them in firewalld explicitly.

Review your published ports and test from the Internet after container changes. If in doubt, schedule a change window and keep the Virtualizor VNC console handy.

Step 8: Keep interfaces and zones right on AlmaLinux

Check which interfaces and sources are in which zones. Correct any mistakes before tightening your rules.

This command shows the current default zone.

sudo firewall-cmd --get-default-zone

This command lists active zones and the interfaces or sources assigned to them.

sudo firewall-cmd --get-active-zones

If you find a public interface in the wrong zone, move it to public. Replace eth0 with your interface name. Plan a console-backed window for this change.

sudo firewall-cmd --zone=public --change-interface=eth0
sudo firewall-cmd --reload

Step 9: Verify state and understand what the firewall keeps for you

AlmaLinux 9 (firewalld)

This command lists what the public zone allows at runtime.

sudo firewall-cmd --zone=public --list-all

Firewalld is stateful. Return traffic for connections you initiate or accept is allowed by connection tracking. You do not need to create separate return rules.

Ubuntu 24.04 (UFW)

This command shows the current UFW status and rules.

sudo ufw status verbose

When removing rules, deleting by specification avoids mistakes caused by rule renumbering. After each numbered delete, check the new numbering before proceeding.

What next

• Carry on through our VPS guides for the rest of your build, including SSH hardening and service configuration.
• If you need a new server to test this on, see our UK and US plans on Linux VPS.
• If anything in your firewall does not behave as expected on a Hostworld VPS, open a support ticket and tell us what you tried and from where you tested.