Updated: 28 September 2026 · Applies to: Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9
A firewall decides which network traffic may reach your server. Current Linux systems use firewalld (AlmaLinux 9 / Rocky Linux 9) or UFW (Ubuntu/Debian); both write nftables rules underneath.
firewalld
systemctl status firewalld systemctl start firewalld systemctl stop firewalld # until the next start or reboot systemctl enable firewalld # start at boot systemctl disable firewalld systemctl mask firewalld # prevent any start, e.g. when using another firewall
UFW
ufw status verbose ufw allow OpenSSH && ufw enable # enable (allow SSH first!) ufw disable
iptables service (legacy)
The old iptables service is deprecated. If an application still needs it on AlmaLinux/Rocky: dnf install iptables-services, systemctl mask firewalld, then systemctl enable --now iptables. Save rules with service iptables save. Run only one firewall service at a time.
Note: Stopping the firewall exposes every listening service to the internet. Stop it only briefly for testing, and start it again.
Tip: On a Ucartz VPS, keep the VNC console open (client area › your VPS service › VPS dashboard) while you change firewall or network settings. If you lock yourself out of SSH, you can still fix it from the console.
