Air-gapped AI server: what it takes
An air gap means no network path at all, and a rented VPS cannot give you one. Build egress-denied inference instead: default-deny outbound, staged weights.
#firewall
Filtering by topic #firewall · clear
Tailscale ports: what to open on your firewall
Tailscale needs no inbound port in most setups. See the outbound ports it uses, why 41641 is not 51820, and the ufw and firewalld rules that help on a VPS.
List the active firewall rules on Ubuntu
Three views of one ruleset on Ubuntu: nft list ruleset, iptables -L -n -v and ufw status. Find shadowed rules with counters and see why Docker skips ufw.
Your Ollama API has no password
The Ollama server ships with no authentication, so anything that reaches port 11434 can run your models and pull new ones. The three fixes, in order.
SSH: Connection Refused vs Connection Timed Out
Two SSH errors, opposite causes. Refused means the server answered. Timed out means nothing answered at all. Learn which test to run, and from where.
Docker bypasses UFW: why and how to fix it
Docker publishes container ports with iptables rules that skip UFW, so a denied port still answers the internet. See the mechanism and the fixes that work.
Check if a port is open on Linux
See what is really listening with ss, then test the port from outside with nc or nmap. Learn why a blocked port hangs while a closed one refuses at once.
iptables vs nftables on Ubuntu
On current Ubuntu the iptables command already writes nftables rules. Prove it on your box, read the native ruleset, and see where ufw and Docker collide.
Recover from a broken ufw ruleset
Locked out by ufw? Get back in through the provider console, disable the firewall, read the rules that actually applied, and stop it happening again.
UFW and IPv6: the open door on your VPS
Your cloud firewall or handwritten iptables may only cover IPv4, leaving services wide open on IPv6. See why it happens on a VPS and how to close the gap.
First 10 minutes on a new VPS
A new VPS is a target from its first minute. This ten-minute runbook creates a user, sets SSH keys, disables root, and turns on the firewall.
FTP passive mode: why your firewall breaks it
FTP logs in fine and then the directory listing hangs. The data channel needs its own ports. Here is the passive range to declare, and the firewall rule.
Cloudflare Tunnel with no open ports
Run Cloudflare Tunnel on a VPS: named tunnel, credentials file, ingress rules, systemd service, then close 80 and 443 and bind the app to localhost.
Self-host a RustDesk relay server
Run RustDesk hbbs and hbbr on your own VPS: the Ed25519 key, pinned image tags, locked down ports, and the relay bandwidth your plan pays for.
firewalld basics for a Rocky or AlmaLinux VPS
Open SSH, allow a web port, close one, and survive a reboot with firewalld on Rocky or AlmaLinux. Zones explained, plus the --permanent trap.
UFW firewall basics: set up a VPS firewall
UFW is the simple way to run a firewall on a VPS. Set a default-deny policy, allow only the ports you need, and turn it on without locking out SSH.