The VirtFusion firewall filters traffic at the hypervisor, before packets reach your VPS. It is a useful outer layer on top of the firewall inside the operating system, and it keeps working even if the VPS is busy or misconfigured.
Before you start
- Access to the VirtFusion control panel for the server.
- Your provider must have enabled the firewall feature.
- A list of services you run and their ports (SSH 22, HTTP 80, HTTPS 443, and so on).
- Your own public IP if you want to restrict SSH to it (check your IP).
Enable the VirtFusion firewall
- Log in to the control panel and open the server.
- Open the Firewall section.
- Add your allow rules before turning on a default deny policy, otherwise you cut your own SSH session.
Add rules
| Service | Protocol | Port | Source |
|---|---|---|---|
| SSH | TCP | 22 | Your IP, or any |
| Web | TCP | 80, 443 | Any |
| DNS (if you host DNS) | UDP and TCP | 53 | Any |
| Ping | ICMP | — | Any |
- Create one rule per service with action accept.
- Add equivalent IPv6 rules if the server has IPv6.
- Set the default inbound policy to drop, then apply.
Tip: Keep a second SSH session open while applying rules. If something goes wrong, use the VNC console, which does not depend on the network firewall.
Check afterwards
- From another machine, test allowed ports:
nc -zv SERVER_IP 443. - Test a blocked port; it should time out.
- Check that outbound traffic (updates, email) still works.
Troubleshooting
- Locked out of SSH: disable the firewall in the panel or remove the deny policy, then fix the rule.
- Website down after enabling: port 443 or 80 rule missing, or IPv6 rule missing while visitors use IPv6.
- Rules seem ignored: make sure you clicked apply and the firewall is enabled for the right interface.
Frequently asked questions
Do I still need UFW or firewalld inside the VPS?
It is good practice. The hypervisor firewall is the outer layer; an OS firewall protects you if the outer one is disabled.
Does the firewall protect against DDoS?
No. It filters by rule; large attacks need upstream DDoS protection.
Can I restrict SSH to my office IP?
Yes, set the rule source to that IP, but keep console access in case your IP changes.