Configure firewall rules for a Virtualizor VPS

A firewall decides which network ports on your VPS are reachable from the internet. Leaving only the services you need open – usually SSH, HTTP and HTTPS – removes most attack surface. Depending on your provider, Virtualizor may offer a firewall in the panel; in all cases you can run a firewall inside the VPS itself.

Before you start

• List the services you run and their ports (see the table below).
• Keep the VNC console available. If a rule blocks SSH, VNC still works.
• If you run a control panel, use its own firewall tool instead – for example the Plesk Firewall or CSF on DirectAdmin – to avoid conflicting rules.

Common ports

Panel firewall (if available)

Some Virtualizor installations show a Firewall or Security section for the VPS. There you can add rules by protocol, port and source IP, and set a default policy. Panel rules filter traffic before it reaches the VPS, which also helps against floods. Exact options depend on your provider; if the section is not present, use the in-VPS firewall below.

UFW on Ubuntu and Debian

1. Allow SSH first: ufw allow 22/tcp (change if you moved SSH).
2. Allow web traffic: ufw allow 80/tcp and ufw allow 443.
3. Set defaults: ufw default deny incoming and ufw default allow outgoing.
4. Enable: ufw enable.
5. Check: ufw status verbose.

Restrict sensitive ports to your own IP, for example:

ufw allow from 198.51.100.20 to any port 22 proto tcp

firewalld on AlmaLinux and Rocky Linux

1. Make sure it runs: systemctl enable --now firewalld.
2. Allow services: firewall-cmd --permanent --add-service=ssh --add-service=http --add-service=https.
3. Open a custom port: firewall-cmd --permanent --add-port=2222/tcp.
4. Apply: firewall-cmd --reload.
5. Check: firewall-cmd --list-all.

Make rules safe to test

Before enabling a new firewall over SSH, schedule an automatic rollback in case you lock yourself out. For example, on Ubuntu run echo "ufw disable" | at now + 5 minutes (install the at package first), enable your rules, confirm that a new SSH session still connects, and then cancel the job with atrm. With firewalld you can test rules without --permanent; they disappear on reload or reboot if something goes wrong.

Add brute-force protection

A firewall blocks ports; Fail2Ban blocks abusive IPs on open ports. Install it to protect SSH and mail; see Fail2Ban jail.local settings.

Troubleshooting

• Locked out of SSH: log in through VNC and run ufw disable or systemctl stop firewalld, then fix the rule.
• Docker containers bypass UFW: Docker inserts its own rules. Bind published ports to 127.0.0.1 or use a reverse proxy.
• Website unreachable after enabling: port 80 or 443 is not allowed. Check the rule list.
• Outgoing mail fails: many providers block outbound port 25 by default; ask support.

Next steps

• First steps on a Linux VPS.
• Fail2Ban with firewalld and nftables.
• Manage VPS IP addresses.