Firewalls: ufw, firewalld and nftables
Which firewall tool your distro uses, and the basics of allowing and blocking traffic.
They're all frontends over the same kernel firewall
Modern Linux firewalling happens in the kernel via nftables (the successor to iptables). ufw and firewalld are just easier command-line interfaces over it, and which one you get depends on your distro — you don't choose freely, so use whichever ships with your OS.
ufw — Ubuntu & Debian
Simple allow/deny rules by port or service name. Deny-by-default is the safe starting point: allow only what you actually need before enabling it, or you can lock yourself out of SSH.
sudo ufw allow 22/tcp # always allow SSH first
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw --force enable
sudo ufw status verbosefirewalld — RHEL, Fedora, openSUSE
Works with named "services" as well as raw ports, and separates temporary (--reload wipes it) from permanent rules.
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
sudo firewall-cmd --list-allRaw nftables, if you need it directly
Arch and minimal setups often have no wrapper installed at all — you write nftables rules yourself. This is more powerful but has a steeper syntax; only reach for it if ufw/firewalld genuinely doesn't cover what you need.
sudo nft list ruleset
sudo nft add rule inet filter input tcp dport 22 acceptAlways allow SSH before enabling anything
The single most common way to lock yourself out of a fresh VPS is enabling a firewall without an SSH allow rule first. If you do get locked out, bashrack's web console (server detail page → Console) still gets you a screen even with SSH blocked.