Firewall in the first hour, not the first month

A VPS firewall belongs in the first hour after you get the server, not weeks later when the site already looks finished. Allow SSH on 22, web traffic on 80 and 443, and port 25 only if this guest will receive mail, then enable the firewall before you install applications. Scanners reach a new public IP quickly, so waiting until WordPress “looks right” leaves installers, xmlrpc, and open database ports exposed for hours.

Pick the firewall your image already uses

On Debian and Ubuntu you will usually work with nftables or ufw. On AlmaLinux and Rocky Linux the default is firewalld. Many cPanel images ship with CSF. Use the tool that came with the image rather than stacking a second one on top of the first. Stacking ufw on firewalld is a common way to lock yourself out while still leaving a hole open.

Allow SSH first from the address you are actually connecting from. Add the web ports next. Open mail ports only if this guest is meant to accept SMTP. Keep databases and Redis bound to localhost unless you have a clear reason to expose them. If the server has an AAAA record, write matching IPv6 rules. A policy that only covers IPv4 leaves IPv6 open, and attackers read AAAA records too.

ss -lntp

That command shows what is really listening, not what you remember installing. A Java app on 8080, phpMyAdmin on 8081, or Docker publishing 3306 on 0.0.0.0 will appear in the list. If something listens on a public address and the firewall does not allow it, you are in good shape. If it listens while the firewall is still off, that is the window you need to close. Confirm you can reach the provider console before you restrict port 22 to a single office IP. A bad allow list with no console access turns into a rescue-mode password reset you did not need.

Two mistakes that still show up in support

The first is installing WordPress on port 80 before the firewall is enabled because you wanted to see the site. The rest of the internet saw it as well: default admin accounts, default table prefixes, and xmlrpc left on while scanners create users. The second is assuming an upstream provider filter is enough on its own. A host firewall on the guest still matters. It is the last word on what this VPS accepts, including traffic from neighbors on the same hypervisor. Edge filtering and a guest firewall are different layers, and both can be true at once.

Allow, enable, then install

Allow the ports you intend to use. Enable the firewall. Install the application after that order is in place. If you open port 25, treat mail as a real decision: reverse DNS, a correct HELO name, and a clear choice about whether this guest receives mail or only sends it. Opening 25 “just in case” is how a quiet VPS ends up next to an open relay in someone else’s reputation report.

On a LogicWeb VPS you have root on KVM, so the guest firewall is yours to configure from the first login. A later OS reinstall will not undo a month of open ports as cheaply as spending the first hour on allow rules and a working console path. Put the VPS firewall in place early, then build on a host that is already closed by default.