Linux

A simple firewall on Linux

Allow SSH, then only the ports your app actually uses. Default deny the rest.

A Noble VPS has a public IPv4. If you leave every port open, the internet will find SSH, panels, and forgotten Redis.

UFW on Ubuntu or Debian

Allow SSH first, then the web ports you actually use. Default deny everything else.

Bash

ufw default deny incoming
ufw default allow outgoing
ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

Add 3389 only if you installed xrdp.
Add panel ports (2087, 8090, 2030) only while you use them, and preferably from your office IP.

firewalld on Alma or Rocky

Bash

firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

Do not lock yourself out

Keep a client-area console session until you have confirmed a new SSH login. If you filter port 22 to the wrong IP, use the console to fix ufw.

Docker and panels

Containers and cPanel rewrite firewall rules. After install, re-check what is actually listening:

Bash

ss -lntup