How do I set up a firewall on my Smart VPS without locking myself out?

A firewall is a bouncer for your VPS; the trick is telling it about SSH before it starts checking IDs.

Steps

Keep your current SSH session open for the whole process. Know where the Serial console is in the portal (your VPS's page, the Serial console button at the top right), as your way back in if a rule goes wrong. If SSH runs on a port other than 22 (ss -tlnp | grep ssh shows it), use that port number wherever you see 22 below. List the other ports you need open, such as 80 and 443 for a website.

1. Log in over SSH as root, or as a user with sudo. Not sure which firewall your system uses? Debian and Ubuntu use ufw and AlmaLinux uses firewalld. cat /etc/os-release tells you which system you have, and ufw status or firewall-cmd --state shows what's installed.

2. Debian or Ubuntu (ufw):

   1. Install it if needed: apt install ufw -y.
   2. Set defaults: ufw default deny incoming then ufw default allow outgoing.
   3. Allow SSH first: ufw allow 22/tcp.
   4. Allow what you host: for example ufw allow 80/tcp and ufw allow 443/tcp.
   5. Turn it on: ufw enable, and answer y.

3. AlmaLinux (firewalld):

   1. Install and start it if needed: dnf install firewalld -y then systemctl enable --now firewalld.
   2. Allow SSH: firewall-cmd --permanent --add-service=ssh.
   3. Allow web traffic if you need it: firewall-cmd --permanent --add-service=http --add-service=https.
   4. Apply: firewall-cmd --reload.
4. Without closing your existing session, open a second terminal and connect with ssh -l root YOUR.IP.ADDRESS. If it works, you're safe.
5. Check the rules: ufw status verbose or firewall-cmd --list-all. ufw lists each rule twice, once for IPv4 and once for IPv6. That's normal.

If it didn't work

• If the second login fails, use your still-open session to fix it: ufw allow 22/tcp or firewall-cmd --permanent --add-service=ssh followed by --reload.
• If you're already locked out, open the Serial console and see our article on recovering from an SSH lockout.
• Still stuck? Open a ticket under Technical Support. Smart VPS is self-managed, so we'll point you in the right direction rather than edit your rules.