VPS Firewall Basics: A Beginner's Guide for Nepali Business Owners

A brand-new VPS, straight out of the box, has far more open doors than any single website or application actually needs. Every open port is a door an automated bot somewhere on the internet is already scanning for. A firewall is simply the tool that closes the doors you're not using, and despite sounding like advanced infrastructure work, setting up a basic one takes a few commands and about ten minutes.

What a Firewall Actually Does, Without the Jargon

Think of your VPS as a building with many doors (ports), each one a potential way in for a specific kind of traffic, web requests, email, remote login, database connections. A firewall is the security guard checking every door and only letting through the specific traffic you've explicitly allowed, blocking everything else by default. Most small business VPS setups genuinely need only two or three doors open: SSH (port 22) for your own access, and HTTP/HTTPS (ports 80/443) if you're running a website.

Setting Up ufw on Ubuntu or Debian (The Beginner-Friendly Option)

ufw (Uncomplicated Firewall) is genuinely built to be approachable, and it's the standard choice on Ubuntu and Debian VPS installs. A basic setup looks like this:

• ufw allow OpenSSH (or ufw allow 22) — keep SSH access open so you don't lock yourself out.
• ufw allow 80/tcp and ufw allow 443/tcp — open web traffic if you're running a website.
• ufw enable — turn the firewall on. It'll warn about SSH connections; confirm you've allowed SSH already before proceeding.
• ufw status — check what's currently allowed at any time.

That's the working core of it for most small business setups. Everything not explicitly allowed gets blocked by default, which is exactly the behavior you want.

The One Mistake That Locks People Out of Their Own Server

Enabling the firewall before confirming SSH access is allowed is the single most common firewall mistake, and it locks you out of your own VPS entirely, often requiring a support ticket with your host to regain access through a web-based console. Always allow SSH explicitly before running ufw enable, and double-check with ufw status before closing your current terminal session.

What to Add as Your Setup Grows

• Running a database accessed remotely: only open that port to specific trusted IP addresses, never to the entire internet.
• Running an email server on the VPS: additional mail-related ports need opening, and this is a case worth getting help with, since mail server security has more moving parts.
• Multiple team members needing SSH access: consider restricting SSH to specific known IP addresses if your team works from consistent locations, adding another layer beyond key-based login.

A Firewall Is a Layer, Not a Complete Security Plan

A properly configured firewall stops a large share of opportunistic, automated attacks, but it's one layer among several. Keeping software updated, using SSH keys instead of passwords, and enabling two-factor authentication where available all matter alongside it, not instead of it. Think of the firewall as closing the doors you're not using, not as the entire security plan by itself.

Getting This Set Up Without the Risk of Locking Yourself Out

If the idea of running firewall commands on your own live server feels risky, that's a reasonable instinct, since a mistake here can genuinely lock you out. WebsNP configures a sensible default firewall on every VPS we set up, and our support team can walk you through opening or closing specific ports as your setup changes, without the risk of a wrong command taking your access away. Message us on WhatsApp if you want your current VPS's firewall reviewed.