---
title: "How to Manage the Self-Managed VPS Firewall"
id: "90034"
type: "ht_kb"
slug: "how-to-manage-the-self-managed-vps-firewall"
published_at: "2026-10-13T00:40:18+00:00"
modified_at: "2026-10-27T22:33:56+00:00"
url: "https://www.greengeeks.com/support/article/how-to-manage-the-self-managed-vps-firewall/"
markdown_url: "https://www.greengeeks.com/support/article/how-to-manage-the-self-managed-vps-firewall.md"
excerpt: "This article explains how to add, change, and remove firewall rules for your Self-Managed VPS in the GreenGeeks dashboard. Use it to control which traffic can reach your server, or to fix a rule that blocks your own access. Table..."
taxonomy_ht_kb_category:
  - "Self Managed VPS Hosting"
  - "Server Questions"
---

This article explains how to add, change, and remove firewall rules for your Self-Managed VPS in the GreenGeeks dashboard. Use it to control which traffic can reach your server, or to fix a rule that blocks your own access.

## Table of Contents

- [How the Dashboard Firewall Works](#how-the-dashboard-firewall-works)
- [How to Add a Firewall Rule](#how-to-add-a-firewall-rule)
- [Firewall Rule Settings](#firewall-rule-settings)
- [How to Edit, Turn Off, or Delete a Rule](#how-to-edit-turn-off-or-delete-a-rule)
- [How to Change the Default Policy](#how-to-change-the-default-policy)
- [Example: Allow Only SSH and Web Traffic](#example-allow-only-ssh-and-web-traffic)
- [If You Lock Yourself Out](#if-you-lock-yourself-out)

## How the Dashboard Firewall Works

- **It runs outside your server.** Rules apply before traffic reaches your server, so they work no matter what is installed on it.
- **Rules are deleted when you rebuild the server.** Add them again after a rebuild.
- **It is always on.** You cannot turn it off. A new server allows all traffic until you add rules or change the default policy.
- **It is separate from firewall software inside your server.** Tools such as ufw or iptables run in addition to the dashboard firewall. Traffic must be allowed by both.
- **Mail blocking rules always apply.** Outbound email on ports 25, 465, and 587 is blocked regardless of your settings.
- **Rules are processed in order**, as listed top to the bottom.
- **Blocking rules affect new connections.** Connections already open stay open unless you select **Also reset the VM’s existing connections** when you add the rule.

## How to Add a Firewall Rule

1. Log in to your GreenGeeks dashboard.
2. Select **Servers** in the left menu.
3. Click **Manage** next to your Self-Managed VPS.
4. Select **Settings** in the left menu.
5. Select **Firewall**.

1. Click **Add Rule**.
2. Choose the **Direction**, **Action**, and **Protocol**.
3. Enter the **Destination port**, such as `22` for SSH or `443` for HTTPS.
4. Enter a **Comment** that describes the rule.

1. Click **Add Rule**.

The rule takes effect right away.

## Firewall Rule Settings

| Setting | Options | What it does |
| --- | --- | --- |
| Direction | Inbound, Outbound | Inbound filters traffic coming to your server. Outbound filters traffic your server sends. |
| Action | ACCEPT, DROP, REJECT | ACCEPT allows the traffic. DROP blocks it silently. REJECT blocks it and tells the sender. |
| Protocol | Any, TCP, UDP, ICMP | The type of traffic. Most web and SSH traffic is TCP. Ping uses ICMP. |
| Source | IP address or range | Where the traffic comes from. Leave blank for any source. |
| Destination | IP address or range | Where the traffic is going. Leave blank for any destination. |
| Destination port | Port number | The port on the receiving side, such as 22, 80, or 443. TCP and UDP only. |
| Source port | Port number | The port on the sending side. Usually left blank. |
| Comment | Up to 255 characters | A note to remind you what the rule is for. |
| Enabled | On or off | Whether the rule is active. |
| Also reset the VM’s existing connections | On or off | Shown for DROP and REJECT rules. Also closes connections that are already open. |

## How to Edit, Turn Off, or Delete a Rule

- **Edit:** click the pencil icon on the rule’s row.
- **Turn off:** switch the toggle in the **On** column off. The rule stays in the list but no longer applies.
- **Delete:** click the trash icon on the rule’s row.

## How to Change the Default Policy

The default policy decides what happens to traffic that no rule matches. Both **Default inbound** and **Default outbound** start as **ACCEPT**.

**Before you set Default inbound to DROP, add an inbound ACCEPT rule for TCP port 22.** Without it, SSH stops working.

1. Open the **Firewall** page.
2. Choose a new value for **Default inbound** or **Default outbound**.
3. Click **Save Policy**.

## Example: Allow Only SSH and Web Traffic

This setup blocks all inbound traffic except SSH and websites.

1. Add an inbound **ACCEPT** rule for **TCP** port `22`.
2. Add an inbound **ACCEPT** rule for **TCP** port `80`.
3. Add an inbound **ACCEPT** rule for **TCP** port `443`.
4. Set **Default inbound** to **DROP**.
5. Click **Save Policy**.

To allow SSH only from your own location, enter your IP address in the **Source** field of the port `22` rule.

If you deployed apps on a Docker Host server, you can also block the direct app ports (for example, `8080`) so visitors can only reach the app through its HTTPS domain.

## If You Lock Yourself Out

The dashboard firewall does not affect the **Terminal**, **Console (VNC)**, or the **Firewall** page itself.

1. Open the **Firewall** page.
2. Turn off or delete the rule that blocks your access.
3. Set **Default inbound** back to **ACCEPT** if you changed it.
4. Click **Save Policy**.

If a firewall inside your server, such as ufw, is blocking you, log in through the **Terminal** to fix it. See [How to Use the Terminal and Console (VNC) on Your Self-Managed VPS](https://www.greengeeks.com/support/article/how-to-use-the-terminal-and-console-vnc/)
 .