Security Hardening - Part 1: Firewall Setup
Why Firewall First?
Before we do anything else, we need to secure your VPS by only allowing necessary traffic.
Step 1: Install UFW (Uncomplicated Firewall)
UFW should already be installed, but let’s make sure:
apt install ufw -y
Step 2: Set Default Policies
# Deny all incoming traffic by default
ufw default deny incoming
# Allow all outgoing traffic
ufw default allow outgoing
Step 3: Allow SSH (CRITICAL - Don’t Skip!)
IMPORTANT: Do this BEFORE enabling the firewall, or you’ll lock yourself out!
ufw allow 22/tcp comment 'SSH'
Step 4: Allow HTTP and HTTPS
For your websites and services:
ufw allow 80/tcp comment 'HTTP'
ufw allow 443/tcp comment 'HTTPS'
Step 5: Allow WireGuard (for homeserver tunnel)
WireGuard typically uses UDP port 51820:
ufw allow 51820/udp comment 'WireGuard'
Step 6: Enable the Firewall
ufw enable
You’ll see:
Command may disrupt existing ssh connections. Proceed with operation (y|n)?
Type y and press Enter.
Step 7: Verify Firewall Status
ufw status verbose
Expected output:
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip
To Action From
-- ------ ----
22/tcp ALLOW IN Anywhere # SSH
80/tcp ALLOW IN Anywhere # HTTP
443/tcp ALLOW IN Anywhere # HTTPS
51820/udp ALLOW IN Anywhere # WireGuard
22/tcp (v6) ALLOW IN Anywhere (v6) # SSH
80/tcp (v6) ALLOW IN Anywhere (v6) # HTTP
443/tcp (v6) ALLOW IN Anywhere (v6) # HTTPS
51820/udp (v6) ALLOW IN Anywhere (v6) # WireGuard
Quick Reference: UFW Commands
# Check status
ufw status
# Add a rule
ufw allow PORT/PROTOCOL
# Delete a rule
ufw delete allow PORT/PROTOCOL
# Disable firewall (careful!)
ufw disable
# Reset all rules
ufw reset