The firewall in the customer area decides what traffic reaches your VPS at all. You set it up by clicking, it works independently of the VPS system, and if you lock yourself out, you fix it with one click. We'll show how to switch it to the safe mode and which rules common services need.
What you'll need
- A StormHost VPS
- Access to the customer area (for a shared service, the Firewall permission)
- A list of the ports your applications use
- About 15 minutes
How the firewall works#
The firewall sits on the network in front of the VPS, not inside it. The rules therefore apply even when the system inside the VPS is broken, and you can't use them to lock yourself out of the customer area or the console.
Open My services, click your VPS and go to the Firewall tab. You'll see:
- Firewall status: Firewall active.
- Inbound traffic: the Allow everything or Block everything except allowed mode.
- Rules: your own rules (at most 50).
- StormHost protection rules: a collapsed list of rules we manage, which can't be turned off.
| Protection rule | What it does |
|---|---|
| Block known internet scanners | Drops traffic from addresses that scan the internet in bulk. |
| Allow traffic to the VPS IP addresses | In the Allow everything mode it lets inbound traffic through. In the Block everything except allowed mode it's off. |
| Outbound only from the VPS IP addresses | The VPS may send traffic only from its own addresses. |
| IP and MAC spoofing protection | The VPS can't pretend to be someone else's address. Protects you and other customers. |
The firewall remembers established connections. Replies to connections the VPS opens itself (updates, downloads, connecting to a database elsewhere) get through in both modes. The rules deal only with new inbound connections.
Inbound traffic mode#
| Mode | What gets through | For whom |
|---|---|---|
| Allow everything | Everything except what you block with your own rule with the Drop or Reject action. | The default for a new VPS. Suitable if you have a firewall inside the VPS (UFW). |
| Block everything except allowed | Only traffic allowed by your own rules with the Allow action. | Recommended. Only what you explicitly open is reachable from outside. |
Add the SSH rule first
Before you switch to Block everything except allowed, add a rule that allows TCP port 22 (or the port you moved SSH to). Without it you won't be able to connect over SSH. The customer area warns you about this when you switch. If it happens anyway, nothing is lost: add the rule afterwards and in the meantime get into the VPS through the browser console.
Switching to the safe mode:
- Add a rule for SSH (see the next section, the SSH button).
- Add rules for all services that should be visible from outside (web, game server…).
- Under Inbound traffic, choose Block everything except allowed.
- Slide the slider in the confirmation dialog.
- In a new window, check that you can connect over SSH and the services work.
On some older VPSs, instead of the mode choice you'll see a Recommended firewall setup box. Click Apply recommended setup. It turns on the protection rules, keeps your own rules and replaces generic “allow all” rules with the recommended set. Then the mode choice appears.
Adding a rule#
The Add rule form is below the list of rules. At the top you'll find the quick presets SSH, HTTP, HTTPS, Minecraft, FiveM TCP, FiveM UDP and Ping, which fill in the form for you.
| Field | What it means | How to fill it in |
|---|---|---|
| Direction | Inbound = connections from the internet to the VPS. Outbound = connections from the VPS out. | Almost always Inbound. |
| Action | Allow = let it through. Drop = silently discard; the sender waits until it times out. Reject = discard and tell the sender right away. | To open a port, Allow. To block attackers, Drop (it gives nothing away). Use Reject for your own services where you want a quick error instead of waiting. |
| Protocol | TCP, UDP, ICMP (ping), ICMPv6, or any. | Depends on the service, see the tables below. Web and SSH = TCP, most games = UDP or both. |
| Port | The destination port on the VPS. Only for TCP and UDP. Formats: one port 22, a list 80,443 (at most 10 items), a range 25565:25570 (from:to). | Empty field = all ports. |
| Source IP / range (for inbound) | Where the connection may come from. One address 198.51.100.25, a range 198.51.100.0/24, an IPv6 address or a comma-separated list (at most 10 items). | Empty = from anywhere. Fill it in only to limit access to specific addresses. Don't mix IPv4 and IPv6 addresses in one field; make a separate rule for each version. |
| Destination IP / range (for outbound) | Where the VPS may connect to. | Empty = anywhere. |
| Note | Your description, at most 100 characters. | Always fill it in, so that in six months you know what the rule is for. |
| enabled | The rule is applied. | Untick it to turn the rule off temporarily without deleting it. |
Click Add. The change applies within a few seconds.
Rule order: rules are evaluated from the top and the first match wins. When you need to block one IP address and at the same time allow a port for everyone, put the Drop rule for that address above the Allow rule. Change the order with the Move up and Move down arrows. StormHost protection rules don't mix with yours: scanner blocking is always first, the general allow always last.
Ready-made rule sets#
All rules below have Direction Inbound and Action Allow. The ports are the programs' defaults; if you changed them in your application, use yours.
| Service | Protocol | Port | Note |
|---|---|---|---|
| SSH | TCP | 22 | Without it you can't connect. |
| Web (HTTP and HTTPS) | TCP | 80,443 | One rule is enough. Let's Encrypt also needs port 80 to issue a certificate. |
| Minecraft Java | TCP | 25565 | |
| Minecraft: query (server listing) | UDP | 25565 | Only if you have enable-query turned on. |
| Bedrock through Geyser | UDP | 19132 | |
| FiveM | TCP | 30120 | |
| FiveM | UDP | 30120 | The game needs both TCP and UDP; that's two rules. |
| txAdmin | TCP | 40120 | Ideally only from your IP address. |
| Rust: game | UDP | 28015 | |
| Rust: query (server list) | UDP | 28017 | The default query port is 1 higher than the higher of the game and RCON ports. |
| Rust: RCON | TCP | 28016 | Only from your IP address. |
| Rust+ (app) | TCP | 28082 | The actual port is printed by the app.info command in the server console. |
| Game panel on your own VPS: node | TCP | 8080,2022 | 8080 = communication between the panel and the node, 2022 = SFTP for game servers. See the node guide. |
| Game panel on your own VPS: servers | TCP and UDP | range, e.g. 25565:25600 | Two rules (TCP and UDP) for the range of ports you assign to servers. |
| MariaDB / MySQL | TCP | 3306 | Always only from a specific IP address, never for everyone. |
| Ping (IPv4) | ICMP (ping) | — | For diagnostics. |
| Ping (IPv6) | ICMPv6 | — | The Ping preset creates only an IPv4 rule; add a second one for IPv6. |
Access only from your IP address#
Type your public IP address in the Source IP / range field. The rule then allows the port only for you. Good for SSH, RCON, txAdmin and databases.
The most reliable way to find your public IP address is from the VPS: connect over SSH and run echo $SSH_CLIENT. The first value in the output (for example 198.51.100.25) is the address you're connecting from right now. If you connect over IPv6, you'll see an IPv6 address and the rule then applies only to IPv6.
Before you limit SSH to your address
- Home connections often change their IP address (after a router restart; on mobile data all the time). After a change you can't connect and have to edit the rule. The browser console always works.
- The Files and Database tabs stop working. The customer area connects to the VPS over SSH from our servers, not from your computer.
IPv6#
Rules with an empty address apply to both IPv4 and IPv6. A rule with an IPv4 address applies only to IPv4, one with an IPv6 address only to IPv6. Ping needs separate ICMP (ping) and ICMPv6 rules.
Outbound rules#
Outbound traffic is allowed by default (from your VPS's addresses). You'll rarely need outbound rules, for example when you want to stop the VPS from sending email directly (an Outbound, Drop, TCP rule for port 25). Be careful not to block DNS (UDP and TCP 53) or updates (TCP 80,443).
Customer area firewall or UFW?#
| Customer area firewall | UFW inside the VPS | |
|---|---|---|
| Where it filters | In front of the VPS | Inside the VPS |
| How you set it up | By clicking | With commands |
| When you lock yourself out | Fix it in the customer area | You have to use the console |
| Docker | Also applies to ports published by Docker | Docker bypasses it (see UFW and Docker) |
Connection rate limiting (limit) | No | Yes |
| Works with fail2ban | No, fail2ban blocks inside the VPS | Yes |
For most people the customer area firewall is enough. Advanced users can use both: the customer area firewall as a coarse filter (only the necessary ports) and UFW with fail2ban inside the VPS. If you use both firewalls, you have to open a port in both.
Verification#
Test from your computer that the port is open:
Windows
Test-NetConnection 203.0.113.10 -Port 22Test-NetConnection– tries to establish a TCP connection. The lineTcpTestSucceeded : Truemeans the port is open and a service responds on it.
macOS
nc -vz -w 5 203.0.113.10 22nc -vz– tries a TCP connection (-zsends nothing,-vprints the result).succeededmeans the port is open.-w 5– gives up after 5 seconds without a reply; otherwise it would wait a long time on a closed port.
Linux
nc -vz -w 5 203.0.113.10 22nc -vz– tries a TCP connection.succeededoropenmeans the port is open. Ifncis missing, install thenetcat-openbsdpackage.-w 5– gives up after 5 seconds without a reply.
The test works only for TCP. A port closed by the firewall shows up as a timeout, a port with no running service as a refusal (refused). Check UDP ports (games) by connecting from the game.
If you lock yourself out#
The customer area firewall never locks you out of the customer area. Open the Firewall tab and either add the missing rule or temporarily switch Inbound traffic to Allow everything.
Troubleshooting#
The firewall changed in the meantime — please reload it.#
Someone else (or another browser window) changed the firewall in the meantime. Reload the page and repeat the change.
Invalid port (for example 22, 80,443 or 25565:25570)#
The port is written incorrectly. Use only digits, commas, and a colon for a range, with no extra spaces. You can enter a port only for TCP and UDP.
The recommended setup can't be applied automatically to this VPS (not all of its IP addresses are known).#
The VPS has an address assigned that the customer area doesn't have on record for the service, and the recommended setup could cut it off. This doesn't depend on settings inside the VPS. Contact us (support) and we'll sort out the addresses.
At most 50 custom rules#
Merge rules: several ports of one protocol into one rule (80,443), consecutive ports into a range (25565:25600).
The port is allowed, but the service doesn't work from outside#
- Check that the rule is enabled and that there's no rule above it that drops the same traffic.
- Check the protocol (a game may need UDP).
- Check the firewall inside the VPS:
ufw status. - Check that the application listens on a public address, not only on
127.0.0.1:ss -tulpn.
After an upgrade or a backup restore, the firewall doesn't behave as before#
After a restore from a backup, the firewall settings are reconciled with the current state of the service. If it reports an error or the rules don't match, contact us (support).
Summary
- The customer area firewall filters traffic in front of the VPS and can't lock you out of the customer area or the console.
- Safe mode: first the rules for SSH and your services, then Block everything except allowed.
- Rules apply from the top and the first match wins; always fill in the note.
- Empty address = the rule covers both IPv4 and IPv6; ping needs both ICMP and ICMPv6.
- Limiting SSH to your IP disables the Files and Database tabs and locks you out when your IP changes.