Configuring the firewall on your cloud server.

Every internet-facing server needs a firewall. Default deny everything, allow only what you need. You have two layers to choose from — use either, or both.

Default state

A new cloud server has no firewall unless you turned one on when you created it. Without one, every port that a program on the server listens on is open to the internet.

We don't enable an OS firewall (ufw / firewalld) on the image either — that's up to you.

One thing is always blocked: outgoing mail on port 25, to protect against spam. If you need it opened, write to support (Help → Write to us).

Option 1: the panel firewall (recommended)

This firewall runs in front of the server, in the cloud network — so a mistake in it can't break the server's own configuration, and you can always change it from the panel.

New panel (rivervo.com/panel): server page → Firewall card → Set up firewall. (Or switch on Use a firewall while creating the server.)

• Inbound rules: only traffic that matches a rule gets through.
• Outbound rules: everything is allowed until you add a rule.
• Each rule has a port, the allowed Sources (or Destinations for outbound) and a Note.
• Presets: SSH (22), HTTP (80), HTTPS (443), Ping (ICMP), or Custom rule.

Change it later with Edit rules → Save rules, or Remove firewall. If none of your rules allows port 22, the panel asks before saving — without it, you can't SSH in.

Option 2: the OS firewall

Inside the server, with ufw (Ubuntu/Debian) or firewalld (Rocky, AlmaLinux, CentOS Stream, Fedora).

Ubuntu/Debian (ufw)

sudo apt install ufw            # if it isn't installed
sudo ufw allow 22/tcp           # allow SSH FIRST
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

Allow only from a specific IP:

sudo ufw allow from 1.2.3.4 to any port 5432 comment "Postgres from office"

Remove a rule:

sudo ufw status numbered
sudo ufw delete 4   # delete rule #4

Rocky / AlmaLinux / CentOS Stream / Fedora (firewalld)

sudo dnf install firewalld      # if it isn't installed
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

Open a port / remove it:

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --permanent --remove-port=8080/tcp
sudo firewall-cmd --reload

Common ports

Don't lock yourself out

Before enabling or changing a firewall, make sure SSH (port 22) is allowed. Then test before disconnecting:

# Keep your current SSH session open.
# Open another terminal and SSH in fresh.
# New connection works → safe to close the original.
# New connection fails → fix it from the original session.

Recovering from a lockout

• Locked out by the panel firewall: server page → Firewall → Edit rules, add SSH (22) back, Save rules. Or Remove firewall.
• Locked out by ufw / firewalld: server page → Console (browser-based, works without SSH). Sign in as root with your root password (shown on the server page; ⋯ → Reset root password if you don't have it), then:

sudo ufw allow 22/tcp           # or: sudo ufw disable
sudo systemctl stop firewalld   # on firewalld systems

fail2ban — automatic IP banning

For SSH and web servers that see a lot of login attempts:

sudo apt install fail2ban    # Debian/Ubuntu
sudo dnf install fail2ban    # Rocky/Alma (from EPEL)
sudo systemctl enable --now fail2ban

The default configuration bans IPs after repeated failed SSH logins. Adjust it in /etc/fail2ban/jail.local.