Cloudflare Tunnel with no open ports
Run Cloudflare Tunnel on a VPS: named tunnel, credentials file, ingress rules, systemd service, then close 80 and 443 and bind the app to localhost.
#firewall
Filtering by topic #firewall · clear
Check if a port is open on Linux
See what is really listening with ss, then test the port from outside with nc or nmap. Learn why a blocked port hangs while a closed one refuses at once.
FTP passive mode: why your firewall breaks it
FTP logs in fine and then the directory listing hangs. The data channel needs its own ports. Here is the passive range to declare, and the firewall rule.
Self-host a RustDesk relay server
Run RustDesk hbbs and hbbr on your own VPS: the Ed25519 key, pinned image tags, locked down ports, and the relay bandwidth your plan pays for.
Your Ollama API has no password
The Ollama server ships with no authentication, so anything that reaches port 11434 can run your models and pull new ones. The three fixes, in order.
Recover from a broken ufw ruleset
Locked out by ufw? Get back in through the provider console, disable the firewall, read the rules that actually applied, and stop it happening again.
iptables vs nftables on Ubuntu
On Ubuntu the iptables command already writes nftables rules. Prove it on your box, read the native ruleset, and see where ufw and Docker collide.
SSH: Connection Refused vs Connection Timed Out
Two SSH errors, opposite causes. Refused means the server answered. Timed out means nothing answered at all. Learn which test to run, and from where.
firewalld basics for a Rocky or AlmaLinux VPS
Open SSH, allow a web port, close one, and survive a reboot with firewalld on Rocky or AlmaLinux. Zones explained, plus the --permanent trap.
Docker bypasses UFW: why and how to fix it
Docker publishes container ports with iptables rules that skip UFW, so a denied port still answers the internet. See the mechanism and the fixes that work.
UFW firewall basics: set up a VPS firewall
UFW is the simple way to run a firewall on a VPS. Set a default-deny policy, allow only the ports you need, and turn it on without locking out SSH.
First 10 minutes on a new VPS
A new VPS is a target from its first minute. This ten-minute runbook creates a user, sets SSH keys, disables root, and turns on the firewall.
UFW and IPv6: the open door on your VPS
Your UFW rules and cloud firewall may only cover IPv4, leaving services wide open on IPv6. See why it happens on a VPS and how to close the gap.