.svg)
.svg)
The LifeinCloud firewall allows you to build custom security policies for your VPS. Here are common rule sets and real-world scenarios you can use as templates. Adjust IPs, ports, and ranges to match your environment.
Secure Linux Web Server
- Allow TCP 22 from
203.0.113.10/32(your admin IP) - Allow TCP 80 from
0.0.0.0/0 - Allow TCP 443 from
0.0.0.0/0 - Drop all other inbound traffic
Tip: If your ISP changes IP often, temporarily allow SSH from 0.0.0.0/0 and later tighten it.
Windows VPS (RDP Access)
- Allow TCP 3389 from
203.0.113.20/32(your IP) - Allow TCP 80, 443 if you also host websites
- Drop all other inbound traffic
Never leave RDP open to the world. Restrict it to your IPs or use a VPN jump host.
Mail Server
- Allow TCP 25,465,587 (SMTP)
- Allow TCP 110,995 (POP3/POP3S)
- Allow TCP 143,993 (IMAP/IMAPS)
- Allow TCP 22 from your admin IP
Some providers restrict outbound 25 by policy; check if you need to use a relay.
Database Server (Private Access)
- Allow TCP 3306 (MySQL/MariaDB) from
10.0.0.0/24(internal network) or specific app server IP - Drop all public access
Databases should never be exposed to 0.0.0.0/0. Use private networking wherever possible.
Game Server (Example: Minecraft)
- Allow TCP/UDP 25565 from
0.0.0.0/0 - Allow TCP 22 from your IP (for admin)
- Drop all other inbound traffic
Different games require different ports or ranges. Always check official docs.
IPv6 Examples
- Allow TCP 22 from
2001:db8:abcd::100/128(your IPv6) - Allow TCP 80, 443 from
::/0 - Drop all other inbound traffic
IPv6 is separate from IPv4. Make sure you mirror rules across both stacks.
Restrict Outbound Connections (Optional)
By default, outbound traffic is open. You can restrict it to add another layer of control:
- Allow outbound TCP 80, 443 (web updates, package repos)
- Allow outbound DNS (UDP/TCP 53)
- Deny all other outbound
Useful for compliance or to stop compromised servers from phoning home.
Best Practices
- Always test new rules with a second SSH/RDP session before closing your main one.
- Start permissive, then tighten step by step.
- Document each rule so you remember why it exists.
- Mirror IPv4 and IPv6 rules if both are active.
