Yes. For most Ubuntu VPS deployments, keep a host firewall such as UFW enabled even when your hosting provider supplies a cloud firewall or security group. The provider layer filters packets before they reach the virtual machine; UFW applies policy on the machine itself. Using both gives you separate control points, provided you configure them deliberately and allow SSH before turning UFW on.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What each firewall actually protects
A cloud firewall (also called a security group by some providers) is enforced upstream, at the provider’s network edge. Traffic that violates its rules should be discarded before it reaches your VPS interface. UFW, the uncomplicated firewall included with Ubuntu, runs inside the guest operating system and evaluates traffic arriving at that host.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
Those locations create different security boundaries rather than two copies of the same control. A cloud rule can protect the instance boundary, while a host rule can make a decision based on the individual machine, its interfaces, or a source address. If one layer is accidentally too permissive, the other can still block an unwanted connection. If either layer is too restrictive, legitimate services fail, so both must be kept consistent.
| Question | Provider cloud firewall | UFW on Ubuntu |
|---|---|---|
| Where is it enforced? | Upstream of the virtual machine, before traffic reaches the instance. | Inside the VPS operating system, on the host itself. |
| Primary scope | The instance’s external network boundary. | The specific host, including traffic that can move between systems on the same private network. |
| How quickly can you change a rule? | Through the provider’s firewall or security-group configuration. | Locally, without editing the provider’s cloud configuration. |
| Useful controls | Coarse access at the provider edge for the instance. | Host-specific source-address controls and rules that can be adjusted for this machine. |
| Failure mode | A mistaken provider rule can expose or block the instance. | A mistaken host rule can expose or block services, including your administrative connection. |
Host-level filtering is especially useful when several VPSs share a private network. A provider rule may allow that network broadly, while UFW on each server can restrict which services accept connections from peer machines. It also lets you change a per-IP rule or a host-specific policy without changing a central cloud object that may affect other instances.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
What Ubuntu enables by default
Ubuntu’s current Server documentation states that UFW is installed but disabled initially. Installing Ubuntu therefore does not mean that a host firewall is already enforcing policy; you must configure and enable it. The documented default incoming policy is deny, while outgoing traffic is allowed when you set the standard baseline.
An older Community wiki page describes ports as open by default. That statement conflicts with the current Ubuntu documentation and should not be used as your configuration guide. Check the effective state on the running server instead of relying on assumptions from an old page.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteBefore enabling UFW, explicitly set the policies you intend to use. If you skip the default policy command, the firewall can operate in an allow mode that is much more permissive than you expected.
sudo ufw default deny incoming
sudo ufw default allow outgoingThese commands establish a deny-by-default posture for new inbound connections while preserving normal outbound connections such as package downloads and updates. You then add only the services that the VPS is meant to provide.
Safe UFW setup without losing SSH
The dangerous mistake is enabling UFW before allowing the SSH service you are currently using. Once enabled, a deny-incoming policy can drop the next SSH connection. If you have no second access path, you may need the provider’s web console or rescue mode to recover.
Rank #2
- 【Professional Firewall & NAS SERVER】OAKNODE 10gbe Firewall Appliance Mini PC-MGNASN, a powerful professional firewall router pc equipped with a 12th Gen Alder Lake N100 4C/4T up to 3.4GHz TDP only 6W with Intel UHD Graphics which maximizes the performance of the 2.5GbE port & SFP+ port, bring you a smooth secured and encrypted network environment.
- 【Rich I/O to meet your needs】Firewall Appliance MGNASN With HDMI 2.0+DP 1.4+TYPE-C(dp 1.2) Support for 3x4K@60Hz together, Dual DDR4 RAM slot support for up to 1x32GB SO-Dimm laptop DDR5 Ram Maximum 5600Mhz and 1xM.2 NVMe/PCIe 3.0x1 2280 SSD slot +1*SATA 3.0 SSD/HDD slots (install externally), also it support boot from TF card slot and it also support PXE/AWOL/Watchdog/GPIO etc. which is perfect for your firewall appliance、VM、Router、home Server needs.
- 【2xSFP+ 10GbE + 4x2.5GbE】This Firewall Router equipped with 2xIntel 82599ES 10gbe network card and 4*Intel i226-V network card speed maximum up to 2.5GbE(need other device like router, cables etc. also support 2.5Gbe/10gbe)which can bring you more faster and professional network usage(some system not release drivers yet) suggest to install version of below systems: pf-sense plus 23.0X or CE 2.7.X, OPNsense 22.1, OpenWrt, ROS7, ESXI 8 , Proxmox, CentOS etc).
- 【4G LTE Function supported】This model also support 4G LTE function(mini PCIE slot for 4G modem) and SIM card slot which you can use it as a IOT devices for your server.
- 【Quality With Warranty】If you have any questions or requirements(like OS installation/ drives/bios updates etc.) on OAKNODE Firewall mini pc MGNASN, PLEASE feel free to contact us. We offered 12 Months warranty for it and WE'LL REPLY YOUR Questions within 12 hours(during Workdays).
1. Confirm how you connect
Identify whether SSH uses the standard service definition or a custom TCP port. If your daemon listens on a nonstandard port, use that exact port in the UFW rule. Do this while your existing SSH session is still open.
2. Set the default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing3. Allow SSH before activation
For the standard SSH service, use the application profile:
sudo ufw allow OpenSSHFor a daemon moved to another port, replace the example with the actual TCP port:
sudo ufw allow <custom-ssh-port>/tcpDo not open both the old and new ports automatically. Allow only the port on which the SSH daemon is really listening, and keep your current session open until a new session succeeds.
4. Add the public services you operate
A web server normally needs HTTP and HTTPS:
sudo ufw allow 80
sudo ufw allow 443Open additional ports only when an application genuinely needs them. A database, cache, control panel, or internal API generally should not be made public merely because its process is listening. If a service is intended only for another VPS on a private network, constrain access to that network or to the required peer addresses using the host’s rules and the provider’s corresponding rules.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #3
- BUSINESS READY - pfSense+ software updates included for product lifetime. Netgate TAC Lite technical support included. One year hardware warranty included.
- COMPLETE - Pre-loaded with pfSense+ software to get up and running fast. Simply unbox it and start customizing for your secure edge networking needs. Free help with setup from our expert Technical Assistance Center (TAC) available 24/7/365.
- POWERFUL - A dual core ARM Cortex-A53 1.2 GHz delivers near gigabit routing of common home iPerf3 traffic and in excess of 650 Mbps of firewall throughput.
- COMPACT - Low power draw, a compact form factor, and silent operation allow it to run unnoticed when placed on a desktop, wall, or rack.
- FLEXIBLE - Three (3) 1 GbE switched (WAN/LAN/OPT) ports allow you to configure three separate 1 GbE switched ports for upto a gigabit of bi-directional traffic.
5. Enable and verify
sudo ufw enable
sudo ufw status verboseRead the resulting status, not just the command’s success message. Confirm that UFW is active, incoming traffic is denied by default, outgoing traffic is allowed as intended, and the SSH and application rules appear. The status output is also the quickest way to spot a typo in a port or profile.
6. Test from a second connection
Start a new SSH connection from your workstation (or another approved management address) before closing the original session. Then test each public service from the network where users will reach it. A rule that looks correct locally can still be blocked by the cloud firewall, a service that is bound only to localhost, or an application that is not running.
Make the two firewall layers agree
Every service that must be reachable has to pass both checkpoints. Mirror the intended allow rules in the provider’s cloud firewall and in UFW. For a web VPS, that normally means permitting TCP 80 and 443 at both layers, plus SSH from the addresses or networks you actually administer from. If the cloud firewall allows a port but UFW denies it, the service is unreachable; if UFW allows it but the cloud firewall denies it, the result is the same.
Keep the policy lists documented together. When you add a service, record its port, purpose, source networks, and which layer was changed. When you retire a service, remove the rule in both places. This avoids the common situation in which an obsolete cloud exception hides an overly broad host rule, or a host rule is opened during troubleshooting and never tightened.
Use the cloud layer for broad, upstream filtering and the host layer for decisions that belong to one machine. For example, you might allow a private application network through the provider firewall but permit only the specific application port on the destination host. Conversely, a temporary host rule for one source address can be changed quickly without modifying a shared provider object.
Rank #4
- 【Processor & OS】Firewall Mini PC with Intel J3710 CPU up to 2.64GHz, 4Cores 4threads 2MB L2 Cache, TDP 6.5w, supports AES-NI. It tested with pf-sens/opn-sense linux ubuntu and other popular open source os. ("DEL" key to enter BIOS)
- 【Interfaces】The firewall pc has 4 * Intel I226 lan ports, 2 * USB3.0 ports, 1 * RS232COM port, 2 * HD port, 1 * DC port. Equipped with VESA mount, you can install the micro pc behind the monitor to save space.
- 【Fanless Design】only 6.5W; fanless heat dissipation design, aluminum alloy shell, efficient and fast heat dissipation, which can withstand temperatures up to 60°C. support 24/7 hours working, no noise.
- 【RAM & Storage】The firewall router equipped with 8G DDR3 RAM, max support 8GB; 128GB mSATA SSD, up to 512GB. Not support HDD. Size:5.27 * 4.98 * 1.43 inches, Weigh:500g, small but powerful.
- 【12 Months Service】You will get a firewall pc and accessories，If you encounter any problems during the use, please contact us through Amazon, we have a professional and efficient team dedicated to serving you.
Recovery if you lock yourself out
If a new SSH session fails immediately after enabling UFW, do not repeatedly restart services or reboot at random. Keep any existing shell open. If all SSH sessions are gone, use the provider’s out-of-band web console or rescue environment, which is designed for access when network rules prevent normal login.
From that recovery path, inspect the UFW status and rules, then add the correct SSH allowance before re-enabling or reloading the policy. The exact console labels differ by provider, but the principle is the same: repair the host rule from a channel that does not depend on the blocked network path. Once a new normal SSH session works, close the emergency session only after checking the final status again.
Plan this recovery option before making firewall changes. A VPS without console or rescue access deserves extra caution: schedule changes when you can reach the provider’s support or recovery channel, and never test a new deny rule by terminating your only working connection.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Checks that prevent subtle gaps
Check the effective rules, not your intention
Use sudo ufw status verbose after every meaningful change. Compare the displayed defaults and rules with the service inventory for the server. A port opened for an old experiment is still an exposed port until you remove it.
Check both address families
IPv6 deserves an explicit review. Guidance for UFW commonly warns that IPv6 handling must be enabled so that IPv6 traffic is governed by the same policy, but the exact setting can vary by Ubuntu release and image. Confirm your release’s UFW IPv6 setting and test an IPv6 connection if the VPS has a public IPv6 address. Do not assume that an IPv4-only test proves the IPv6 path is protected.
Best Value
- 【CPU Optimized for Firewall Mini PCs】This firewall appliance is powered by Intel Quad-Core Celeron J1900, 64-bit, up to 2.0 GHz, supporting software-based encryption. Energy-efficient and reliable, it runs 24/7 for home or small office networks, handling VPNs, multi-WAN routing, and basic firewall tasks efficiently.
- 【4×Intel i210 Ports】Equipped with four Intel i210 network controllers, each delivering up to 1 GbE for reliable multi-WAN routing, VPN connections, VLAN management, and stable performance in small office or home firewall deployments
- 【Memory & Storage】This Firewall Mini PC comes with 4 GB DDR3L RAM and a 64 GB mSATA SSD, providing reliable performance for basic networking tasks. AMI BIOS with ACPI support ensures stable system operation and energy-efficient 24/7 use
- 【Flexible System Compatibility】Compatible with Windows 10, Linux, and professional firewall systems such as pfSense, OPNsense, and VyOS, ensuring stable network management for home or small office use
- 【After-Sales Support:】This compact, fanless, and silent firewall keeps your network secure. Includes lifetime technical support and a 30-day money-back guarantee!
Check container-published ports
Container runtimes can install their own packet-filtering rules. Secondary guidance reports that Docker-published ports may bypass a straightforward UFW policy, but the specific bypass behavior and the recommended DOCKER-USER-based fix were not verified against Docker’s current official documentation here. Treat published container ports as a separate verification task: list every host port exposed by containers, test reachability from an untrusted network, and confirm which layer is actually enforcing the restriction before relying on UFW alone.
Check the application binding
A firewall rule cannot make a service reachable if the process is stopped or bound only to 127.0.0.1. Conversely, a process listening on all interfaces may become public as soon as both firewall layers allow its port. Check the service’s own bind address and intended audience whenever you add an allow rule.
When a second firewall can hurt
Running two layers is useful, but it is not automatically safer if nobody owns the rule set. Duplicate rules, undocumented emergency exceptions, and conflicting IPv4/IPv6 behavior make incidents harder to diagnose. Establish one change procedure: define the source and destination, update the provider rule and UFW rule as a pair, verify from an allowed client, and record the result.
A cloud firewall also cannot compensate for an exposed management port that accepts weak credentials, and UFW cannot fix an application vulnerability. Continue using SSH keys or another strong authentication method, keep the operating system and services updated, and expose the smallest service surface required by the deployment. Firewalls reduce reachable paths; they do not replace patching, authentication, or application-level authorization.
A practical decision framework
- Single public web VPS: enable UFW, deny incoming by default, allow SSH plus 80 and 443, and mirror those rules in the provider firewall.
- Several VPSs on one private network: keep both layers. Use the cloud firewall to define the network boundary, then use host rules to restrict peer-to-peer traffic to the ports each machine needs.
- Custom SSH port: allow that exact TCP port before enabling UFW, and verify a second login before ending the original session.
- Container host: keep UFW, but separately audit container-published ports because Docker’s packet rules may not follow the simple UFW model.
- IPv6-enabled VPS: verify UFW’s IPv6 configuration and test IPv6 reachability; an IPv4-only check is incomplete.
- No provider console or rescue access: make smaller changes, preserve an active session, and arrange an out-of-band recovery path before enabling a deny policy.
Bottom line
A provider firewall and UFW solve different parts of the same exposure problem. The provider filters before traffic reaches the VPS; UFW enforces policy on the host and can control traffic among machines that share a network. Ubuntu does not enable UFW for you, and enabling it in the wrong order can cut off SSH. Set deny-by-default incoming policy, allow your real SSH port first, add only required services, enable and inspect the status, then keep the cloud and host rules synchronized. Treat IPv6 and container-published ports as explicit checks rather than assumptions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
