Your VPS server: updates and the firewall

What you'll achieve

• bring the system up to date;
• turn on automatic security updates;
• leave open only the ports you use.

Before you start

• If you have more than a blank server you've just received, ask us for a snapshot first (by email or WhatsApp; we take it the same business day). The snapshots in your plan are included in the price.
• You know what runs on the server and on which ports: SSH on 22, a website on 80 and 443, n8n or other apps on their own ports.
• Keep an SSH session open while you configure the firewall. If you accidentally block SSH, you can fix it from there.

The steps

A. Bring the system up to date

1. Ubuntu and Debian:

   sudo apt update && sudo apt upgrade

2. AlmaLinux and Rocky:

   sudo dnf upgrade

3. Check whether a reboot is needed (for example after a new kernel):
   • Ubuntu and Debian: if the file /var/run/reboot-required exists, reboot;
   • AlmaLinux and Rocky: sudo dnf install dnf-utils, then sudo needs-restarting -r.
4. Reboot with sudo reboot, wait a minute and log in again.

B. Turn on automatic security updates

5. Ubuntu: the unattended-upgrades package is usually installed and enabled. Check:

   sudo dpkg-reconfigure -plow unattended-upgrades

   Answer Yes. From now on, security updates install themselves, daily.

6. Debian:

   sudo apt install unattended-upgrades
   sudo dpkg-reconfigure -plow unattended-upgrades

7. AlmaLinux and Rocky:

   sudo dnf install dnf-automatic

   In /etc/dnf/automatic.conf, in the [commands] section, set apply_updates = yes (and, if you only want security updates, upgrade_type = security). Then:

   sudo systemctl enable --now dnf-automatic.timer

8. Automatic updates don't reboot the server. Once a month, or when you read about a major vulnerability, check step 3 and reboot at a quiet time.

C. Turn on the firewall — Ubuntu and Debian (UFW)

9. On Debian, install it: sudo apt install ufw. On Ubuntu it is already installed.

10. Allow SSH first, or you will lock yourself out:

    sudo ufw allow OpenSSH

    If you moved SSH to another port, allow that port: sudo ufw allow 2222/tcp.

11. Allow whatever else you use, for example a website:

    sudo ufw allow 80/tcp
    sudo ufw allow 443/tcp

12. Turn on the firewall and check:

    sudo ufw enable
    sudo ufw status verbose

    By default, UFW blocks all incoming traffic that isn't allowed and lets all outgoing traffic through.

D. Turn on the firewall — AlmaLinux and Rocky (firewalld)

13. Make sure it is running: sudo systemctl enable --now firewalld.
14. SSH is usually allowed from installation. Check and add what you use:

    sudo firewall-cmd --permanent --add-service=ssh
    sudo firewall-cmd --permanent --add-service=http
    sudo firewall-cmd --permanent --add-service=https
    sudo firewall-cmd --reload
    sudo firewall-cmd --list-all

E. Check from outside

15. From a new window, log in again over SSH. If it works, the firewall is fine.
16. Open your public services in the browser (the website, the app's dashboard) and check that they load.
17. See which ports are listening on the server: sudo ss -tulpn. Any service listening on 0.0.0.0 or [::] that doesn't need to be public (a database, Redis) should either be stopped, bound only to 127.0.0.1, or left blocked in the firewall.

Watch out for Docker

If you chose the image with Docker, n8n, Dokploy or another app that runs in containers, Docker creates its own network rules and bypasses UFW: a port published by a container (for example with -p 5678:5678) is reachable from the internet even if UFW doesn't allow it. To keep a container from being public, publish the port only locally (-p 127.0.0.1:5678:5678) and put a web server with HTTPS in front of it, or use the firewall rules from the Docker documentation.

If something doesn't work

• After ufw enable you can no longer log in over SSH. You didn't allow SSH or its port. From the session you kept open: sudo ufw allow OpenSSH (or your port). If you no longer have any session open, write to us: we will tell you your options, for example restoring from a snapshot.
• apt upgrade asks something about a configuration file. If you haven't modified the file, choose the package version (install the package maintainer's version); if you have modified it, keep yours.
• A website or app stops responding after the firewall is on. Its port isn't allowed. Add it (steps 11 or 14).
• Uptime monitoring says the website isn't responding. Our bot checks from outside, like any visitor; the website's port must be open in the firewall (see Your VPS server: backups and monitoring).