Protect your way back in
Use UFW on Ubuntu 24.04 LTS or firewalld on AlmaLinux 9. This guide assumes a simple VPS with one public network connection. Keep your current SSH session open and make sure your recovery console works. Do not combine these tools with another firewall manager.
Identify the server-side SSH port from your current session. It is usually 22; some servers use a different port. If this prints an empty value, stop and set SSH_PORT manually. Confirm it matches the listening port and your connection before continuing. Provider-level firewall rules are separate.
SSH_PORT=${SSH_CONNECTION##* }
printf 'Current SSH port: %s\n' "$SSH_PORT"
sudo ss -lntpUbuntu: allow SSH before enabling UFW
Install UFW if needed, inspect its rules, and add your actual TCP port before enabling it. Existing rules should be reviewed rather than reset. The incoming policy blocks new unsolicited connections, while the outgoing policy permits normal package downloads and DNS requests.
sudo apt update
sudo apt install ufw
sudo ufw status verbose
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow "$SSH_PORT/tcp"
sudo ufw enable
sudo ufw status numberedAlmaLinux: choose the correct zone
Install firewalld and check whether it is already active. For a running service, inspect active zones and choose the zone attached to your public interface. Set ZONE to that name; public below is an example.
If firewalld is inactive, review the offline default and the public connection's zone. Replace YOUR_CONNECTION_NAME with its name from the active connection list. An empty connection.zone uses the default. Use the next section's offline branch with the matching zone. Do not change interface assignments just to follow an example.
sudo dnf install firewalld
sudo systemctl is-active firewalldsudo firewall-cmd --get-active-zonessudo firewall-offline-cmd --get-default-zone
nmcli -f NAME,DEVICE connection show --active
nmcli -f connection.id,connection.interface-name,connection.zone connection show 'YOUR_CONNECTION_NAME'AlmaLinux: add SSH in the appropriate branch
For an active firewall, add SSH to both runtime and permanent configuration. For an inactive firewall, write the allow rule offline before enabling it. Run only the branch matching your service state. Both branches retain the actual port in SSH_PORT.
ZONE=publicsudo firewall-cmd --zone="$ZONE" --add-port="$SSH_PORT/tcp"
sudo firewall-cmd --permanent --zone="$ZONE" --add-port="$SSH_PORT/tcp"
sudo systemctl enable firewalldsudo firewall-offline-cmd --zone="$ZONE" --add-port="$SSH_PORT/tcp"
sudo systemctl enable --now firewalldAllow application traffic only when needed
A web server normally needs TCP 80 and 443. Add those only if you serve a website. UFW uses allow 80/tcp and allow 443/tcp; firewalld uses the http and https services in your reviewed zone. Keep databases and internal dashboards private unless you have a specific access requirement.
Verify a new connection
From a second terminal, connect with your actual SSH port and test sudo. Inspect the firewall rules again. An existing session staying connected does not prove new logins work. Close the original session only after the fresh connection succeeds.
ssh -p YOUR_PORT deploy@YOUR_SERVERsudo firewall-cmd --zone="$ZONE" --list-all
sudo firewall-cmd --permanent --zone="$ZONE" --list-allOfficial documentation
These upstream references provide more detail on the commands and workflows in this guide.