You decide which services we may enable for analytics, personalization, and external content.
We use cookies and similar technologies on our website to personalize content, embed external media, and better understand how individual areas are used.
Necessary cookies
These entries support essential functions such as security, stability, and form processing.
Optional sections
AnalyticsMarketingPersonalizationExternal media
Your data may be processed with your consent or on the basis of legitimate interests. In the cookie settings, you can reject or explicitly allow each optional category.
Some services process personal data in third countries. By consenting, you also agree to this transfer. You can find more information in our Privacy Policy.
You can reopen and change your selection at any time. Β· 1.0.2
Learn how to configure a firewall to secure your server and allow the external connections you need β Find out more
10 November 20264 min read0 Views0 helpful
Introduction
Many services and programs require you to allow external connections. The best way to do this is to set up a firewall.
In this guide, you'll learn how to configure a firewall and allow these connections.
FAQ
Frequently asked questions
UFW and IPTables. The guide starts with UFW because it's easier to set up and manage.
Run 'sudo apt install ufw'.
Run 'sudo ufw default deny incoming' and 'sudo ufw default allow outgoing'. Then explicitly allow SSH and any other required ports (e.g., 'sudo ufw allow 22') before enabling UFW.
Yes. Your VPS has an additional network firewall in the ZapX dashboard (the Network Firewall tab), which is applied before traffic reaches your server. By default, it is set to ACCEPT for incoming and outgoing traffic. If you've set more restrictive rules there, you'll also need to allow the same ports there.
Feedback
Was this article helpful?
Your feedback helps us prioritize and improve content.
0 of 0 Users found this article helpful.
Personal support
Need more help than the guide provides?
Our ZAP support team knows your product β briefly describe your issue and we'll help you personally.
Navigation
VPS
Before you begin
To install the firewall, you need to connect to your server via SSH. If you don't know how, take a look at our initial connection guide.
After connecting, update your server to the latest version with apt update and apt upgrade.
Info
Additional network firewall in the ZapX dashboard
This guide covers the firewall on your server (UFW/IPTables). In addition, your VPS has an extra network firewall in the ZapX dashboard (the Network Firewall tab), which is applied before traffic reaches your server. By default, it is set to ACCEPT for incoming and outgoing traffic, so it won't affect the steps below. However, if you've set more restrictive rules there yourself (e.g., a DROP/REJECT policy or custom firewall rules), you'll also need to allow the same ports there.
Using UFW (Easy)
There are several firewall programs for Linux. In this guide, we'll focus on the two most popular: UFW and IPTables.
We'll start with UFW because it's easier to set up and manage.
Installing UFW
You can easily install UFW via APT with sudo apt install ufw.
To avoid losing your SSH connection, don't enable the firewall yet. Configure it properly first.
Now you should allow your SSH connection and any other ports you want to open:
sudo ufw allow 22 for SSH
sudo ufw allow 80 as an example for HTTP
sudo ufw allow 25565 as an example for a Minecraft game server
To enable UFW, run sudo ufw enable. You can open additional ports at any time with sudo ufw allow PORT.
Adding port rules
To allow a port, you can simply use this command:
For TCP ports:
sudo ufw allow PORT/tcp β replace PORT with the port you want to allow.
Example: sudo ufw allow 25565/tcp for a Minecraft game server
For UDP ports:
sudo ufw allow PORT/udp β replace PORT with the port you want to allow.
Example: sudo ufw allow 9987/udp for a TeamSpeak 3 server
Viewing and removing port rules
To view all port rules, use sudo ufw status numbered.
To delete a rule, run sudo ufw delete NUMBER, where NUMBER is the rule's number in the list.
Installing IPTables (Advanced)
Most systems have IPTables installed by default, but to be sure, you can run sudo apt install iptables.
Configuring IPTables
First, set the default policies and settings:
sudo iptables -P INPUT DROP β block all incoming connections
sudo iptables -P FORWARD DROP β block all forwarded connections
sudo iptables -P OUTPUT ACCEPT β allow all outgoing connections
sudo iptables -A INPUT -i lo -j ACCEPT β allow loopback traffic
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT β allow all existing connections
Now you should allow SSH and any other ports you want to open:
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT for SSH
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT as an example for HTTP
sudo iptables -A INPUT -p tcp --dport 25565 -j ACCEPT as an example for a Minecraft game server
To keep the rules after a reboot, install the iptables-persistent package with sudo apt install iptables-persistent.
Save the rules with sudo netfilter-persistent save and enable automatic startup with sudo systemctl enable netfilter-persistent.
Adding port rules
To allow a port, you can use this command:
For TCP ports:
sudo iptables -A INPUT -p tcp --dport PORT -j ACCEPT β replace PORT with the port you want to allow.
Example: sudo iptables -A INPUT -p tcp --dport 25565 -j ACCEPT for a Minecraft game server
For UDP ports:
sudo iptables -A INPUT -p udp --dport PORT -j ACCEPT β replace PORT with the port you want to allow.
Example: sudo iptables -A INPUT -p udp --dport 9987 -j ACCEPT for a TeamSpeak 3 server
Viewing and removing port rules
You can view all rules with sudo iptables -L --line-numbers.
To delete a rule, use sudo iptables -D INPUT NUMBER, where NUMBER is the rule's number in the list.
Conclusion
You've successfully installed a firewall on your Linux server and created your own port rules. You can also use this guide to allow additional ports.
If you have any questions or run into problems, our support team is here to help every day! π
Server hosting from β¬2.49 / month, online instantly, DDoS protection included.
Preferred source on Google
