Secure your server: combining the panel firewall and UFW

Every server on the internet is probed constantly, mostly on SSH. Two firewalls keep that out: the firewall in your customer account, which acts in front of your server, and UFW inside the server. Here you set up both so that only SSH, HTTP and HTTPS get through.

The firewall in your account

Open your server and go to the Firewall tab. This firewall runs on our host, so it acts before a packet even reaches your server. It still protects you if something inside the server is misconfigured.

When the server is set up it is active but lets incoming and outgoing traffic through. Restrict it like this:

1. First create the rules via Add rule:
   • direction inbound, action ACCEPT, protocol TCP, port 22 (SSH)
   • the same for ports 80 and 443 if you run a website
2. If you only want to allow SSH from home, enter your address under Source in the rule for port 22, for example 192.168.1.7, or a whole network such as 192.168.1.0/24.
3. Only then set Default inbound to DROP and save.

Order matters: first the rule for SSH, then inbound to DROP. The other way round, the firewall cuts your own connection. If it happens anyway, the Console tab still gets you onto the server so you can add the rule.

Keep the outbound default at ACCEPT, otherwise your server can no longer download updates.

UFW inside the server

UFW is the simplest firewall for Debian and Ubuntu. It also protects you if you later start a service and forget to secure it.

sudo apt update && sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw enable

Check:

sudo ufw status verbose

Why both?

	Panel firewall	UFW
Where it acts	in front of the server, on our host	inside the server
Still works if the server is misconfigured	yes	no
Can be changed without logging in to the server	yes	no
Rules per program or user	no	yes

What about DDoS?

You do not need to set anything up against large attacks: DDoS protection is always on for every server at no extra cost. You can see what it does in the DDoS protection tab.

Check at the end

From your computer, test that port 22 is open and, say, port 3306 is closed:

nc -zv 10.0.0.25 22
nc -zv 10.0.0.25 3306