> ## Documentation Index
> Fetch the complete documentation index at: https://docs.crazynode.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Firewall Setup

> Configure UFW or firewalld on your CrazyNode VPS to allow only trusted traffic.

A firewall blocks unwanted traffic before it reaches your applications. On CrazyNode VPS, you have three options: **UFW** (easiest), **firewalld** (RHEL-family), or raw **iptables/nftables**.

## UFW (Ubuntu / Debian)

<Steps>
  <Step title="Install UFW">
    ```bash theme={null}
    apt install ufw -y
    ```
  </Step>

  <Step title="Set default policies">
    ```bash theme={null}
    ufw default deny incoming
    ufw default allow outgoing
    ```
  </Step>

  <Step title="Allow SSH BEFORE enabling">
    ```bash theme={null}
    ufw allow 22/tcp
    ```

    <Warning>
      Forgetting this step will lock you out. Use the VNC console to recover.
    </Warning>
  </Step>

  <Step title="Allow additional services">
    ```bash theme={null}
    ufw allow 80/tcp     # HTTP
    ufw allow 443/tcp    # HTTPS
    ```
  </Step>

  <Step title="Enable UFW">
    ```bash theme={null}
    ufw enable
    ufw status verbose
    ```
  </Step>
</Steps>

### Common UFW commands

```bash theme={null}
ufw allow 3306/tcp                     # allow MySQL
ufw allow from 1.2.3.4                 # allow all from one IP
ufw allow from 1.2.3.4 to any port 22  # allow SSH only from one IP
ufw delete allow 3306/tcp              # remove a rule
ufw reload                             # reload rules
ufw disable                            # turn off (careful)
```

## firewalld (AlmaLinux / Rocky)

```bash theme={null}
systemctl enable --now firewalld
firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload
firewall-cmd --list-all
```

## Network-level filtering

Every CrazyNode VPS also sits behind a network-level filter that blocks obvious DDoS traffic before it reaches your VM. Your local firewall protects against everything else.

<Tip>
  Only open ports you actively use. Every open port is a potential attack surface.
</Tip>