Every server connected to the public Internet is subjected to continuous port scanning and exploit probes. A host-based firewall acts as a protective barrier, dictating exactly which network ports are allowed to receive inbound traffic and which are dropped.
UFW (Uncomplicated Firewall) is an easy-to-use frontend for Linux iptables / nftables designed to make firewall management intuitive and reliable on your RivinCloud VPS.
1. Setting Up Default Firewall Policies
The safest firewall architecture follows the principle of least privilege: block all incoming traffic by default and permit all outgoing requests.
# 1. Block all incoming connection attempts by default
sudo ufw default deny incoming
# 2. Allow all outgoing requests initiated by the server
sudo ufw default allow outgoing
2. CRITICAL: Allow SSH Before Enabling UFW!
[!WARNING] Never enable UFW without explicitly opening your SSH port first! If you enable UFW with the default deny policy without allowing SSH, you will lock yourself out of your server permanently!
Allow Standard SSH (Port 22)
sudo ufw allow 22/tcp
# or
sudo ufw allow ssh
If you use a custom SSH port (e.g. 2222):
sudo ufw allow 2222/tcp
3. Opening Ports for Services
Depending on the role of your server, open only the necessary ports:
1. Web Servers (Nginx / Apache)
# Allow HTTP (Port 80) and HTTPS (Port 443)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
# Or use application profile:
sudo ufw allow "Nginx Full"
2. Game Servers (e.g., Minecraft)
sudo ufw allow 25565/tcp
3. Port Ranges (e.g., Voice or Passive FTP)
sudo ufw allow 6000:6005/tcp
sudo ufw allow 6000:6005/udp
4. IP Whitelisting and Advanced Rules
For maximum security, restrict sensitive services (like MySQL, Redis, or SSH) to your specific home/office IP address:
Allow All Traffic from a Specific IP Address
sudo ufw allow from 203.0.113.50
Allow a Specific IP Access to a Specific Port Only
sudo ufw allow from 203.0.113.50 to any port 3306 proto tcp
Block (Deny) Malicious IP Addresses
sudo ufw deny from 198.51.100.25
5. Enabling and Checking UFW Status
Activate UFW
sudo ufw enable
(Press y and Enter when prompted).
Check Active Rules with Numbered Index
sudo ufw status numbered
Output:
Status: active
To Action From
-- ------ ----
[ 1] 22/tcp ALLOW IN Anywhere
[ 2] 80/tcp ALLOW IN Anywhere
[ 3] 443/tcp ALLOW IN Anywhere
[ 4] 22/tcp (v6) ALLOW IN Anywhere (v6)
Deleting a Rule by Number
sudo ufw delete 2
Common Mistakes
- Enabling UFW before adding SSH rule: This locks you out of the server immediately.
- Forgetting protocol type in port rules:
ufw allow 80opens both TCP and UDP port 80. If you only need TCP, specify80/tcp.
Troubleshooting
- Locked out of your VPS? Use the RivinCloud web VNC / Out-of-Band console in your dashboard to log in locally and run
sudo ufw disable.
Best Practices
- Enable rate limiting on SSH to mitigate brute force attacks:
sudo ufw limit ssh/tcp - Always review
sudo ufw status numberedafter making changes.
Frequently Asked Questions
Does UFW persist after server reboot?
Yes. Once enabled with sudo ufw enable, systemd ensures UFW rules are applied automatically upon system startup.
Conclusion
Configuring UFW takes less than five minutes and blocks thousands of automated network scans every day. Harden your RivinCloud VPS with a properly configured UFW firewall today!