Controlling what can reach your server.
THE PRINCIPLE
Deny everything by default, then permit only what you need. This is the opposite of how servers arrive configured.
WHAT TO PERMIT
SSH, on whichever port you use HTTP and HTTPS, ports 80 and 443 Mail ports, if the server handles mail Your control panel ports, if you run one Anything specific to your applications
WHAT TO BLOCK
Everything else, particularly database ports. A database reachable from the internet is a serious exposure and a common cause of compromise.
THE TOOLS
firewalld on Rocky and AlmaLinux ufw on Ubuntu and Debian CSF, which is common alongside cPanel and provides brute-force protection too
Use one. Running two firewall managers simultaneously produces confusing results.
BEFORE APPLYING RULES
Keep an SSH session open. A firewall rule that blocks your own access is easy to write, and the open session is how you undo it.
TESTING
From another machine, confirm that permitted ports respond and others do not. Online port scanners can check from outside.
