Security3 min readUpdated 2026-04-30

Firewall basics with ufw

Default-deny inbound, allow only what you need. Standard ufw rules for a typical web VPS.

ufw is a friendly wrapper around iptables/nftables. The right starting policy: deny all inbound by default, allow only the ports your services need.

Install ufw

apt install ufw -y    # Ubuntu/Debian
dnf install ufw -y    # AlmaLinux/Rocky

ufw default deny incoming
ufw default allow outgoing

Before enabling the firewall, allow your SSH port — otherwise you lock yourself out:

ufw allow 22222/tcp

If you're running a web server:

ufw allow 80/tcp
ufw allow 443/tcp

ufw enable
ufw status verbose

The last command shows your full ruleset. Keep it clean — every open port is attack surface.

Harden SSH on your offshore VPS

Disable password auth, enforce keys, change the port, restrict source IPs, and rate-limit attempts.

Set up fail2ban in 5 minutes

Auto-ban IPs that fail too many SSH login attempts. The single highest-ROI security tool for VPS.

Anonymous signup. Bitcoin & Monero accepted. Provisioned across 8 jurisdictions.

No credit card required · 7-day money-back guarantee