How do I set up a firewall on a VPS?

Remember IPv6. A ruleset that only covers IPv4 leaves every service reachable over v6, and every instance here has a routed /64. ufw handles both by default; hand-written nftables rules need an ip6 table or an inet table.

Test before you commit. A common pattern is to schedule a job that flushes the rules in ten minutes, apply the new policy, verify you are still connected, then cancel the job.

• ufw default deny incoming; ufw default allow outgoing
• ufw allow 22/tcp (or your chosen port) before ufw enable
• ufw allow 80,443/tcp for web services
• Confirm IPv6 is covered — check ufw status verbose or your nft ruleset