Skip to content
VdsRent
Beginner5 min read

Firewall basics for a new server

Default-deny, the three rules almost everyone needs, and how not to lock yourself out.

Last updated 1 August 2026

Allow SSH before you enable the firewall

Enabling a default-deny policy without an SSH rule ends your session and does not let you back in. Console access, where the plan supports it, is the way back.

A starting ruleset

bash
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 80,443/tcp
ufw enable
ufw status verbose

Narrow it further

If you always connect from a known network, restrict SSH to it. That single change removes most of the noise from your logs.

bash
ufw delete allow 22/tcp
ufw allow from 198.51.100.0/24 to any port 22 proto tcp

Was this page useful?

Feedback about article firewall-basics

Related guides

Firewall basics for a new server — Guide — VdsRent