The Second Thing Every Non-Coder Should Do After Buying a VPS: Enable the Firewall

When I first bought my own VPS, I was honestly excited just to see Ubuntu running.

I felt like:

“Now I own a real server.”

I installed the OS, connected through SSH, deployed my app using PM2, opened the domain… and the app worked.

At that moment, I thought:

“Done. Server setup complete.”

But later I realized something important:

Installing the OS is only the first step.

The second most important step is enabling a firewall properly.

And many beginners skip it completely.

What I Thought Initially

As a non-coder learning through AI tools like Claude Code and OpenAI Codex, I initially believed:

if SSH works
if PM2 is running
if my app opens in browser

…then the server is safe.

But that is not true.

By default, many VPS servers expose ports openly unless you explicitly restrict them.

That means:

unnecessary ports may remain open
services may become reachable publicly
random bots can scan your server
unwanted traffic can hit services directly

And beginners often do not even realize this is happening.

Why Firewall Matters So Much

Think of a firewall like the main security gate of your VPS.

Without firewall rules, your server may accept connections on ports you forgot about.

For example:

development ports
test APIs
databases
admin dashboards
temporary Node.js ports

Sometimes while testing apps, we expose ports just to “quickly check something.”

Then we forget to close them.

That becomes dangerous later.

The Mistake Many Beginners Make

The common beginner workflow looks like this:


Buy VPS
↓
Install Ubuntu
↓
Install Node.js
↓
Run PM2
↓
App works
↓
Done

But firewall configuration is missing there.

A safer flow is:


Buy VPS
↓
Install OS
↓
Enable firewall
↓
Allow only required ports
↓
Deploy app
↓
Test app
↓
Open additional ports only if needed

My Simple Rule Now

Now I follow a simple approach:

Open only the ports actually required.

Usually:

Port 22 → SSH
Port 80 → HTTP
Port 443 → HTTPS

Everything else stays blocked unless truly needed.

PM2 and App Testing Changed My Thinking

Initially, when testing PM2 apps, I used to directly expose app ports publicly.

For example:

React frontend
Node backend
test APIs
temporary admin panels

Because I just wanted to quickly test whether the app was working.

But later I understood:

just because PM2 runs on a port does not mean that port should remain publicly accessible forever.

Now my flow is more careful.

My Current Beginner-Friendly Workflow

Now I usually do this:

Step 1

Deploy app with PM2.

Step 2

Temporarily allow the app port in firewall.

Step 3

Test whether the app works correctly.

Step 4

Move traffic properly through Nginx reverse proxy.

Step 5

Close unnecessary direct public ports later if not needed.

This reduced confusion and made my setup cleaner.

The Good Thing About VPS Panels Today

The good part is that many VPS providers now offer simple firewall UI panels.

You no longer need to memorize complex Linux firewall commands initially.

You can simply:

create ACCEPT rules
choose TCP
enter port numbers
block remaining traffic

That makes learning much easier for non-coders.

One Important Realization

Earlier, I used to think:

“Firewall is only for advanced DevOps engineers.”

But honestly, firewall setup is one of the most practical beginner security steps.

Because when you start hosting:

APIs
AI tools
dashboards
databases
admin panels

…your VPS slowly becomes a real internet-facing machine.

And internet bots continuously scan public IPs automatically.

I Am Still Learning Too

Even now, I am not a cybersecurity expert or DevOps engineer.

I still learn many things through:

AI tools
trial and error
production mistakes
debugging sessions

But enabling firewall early is one habit I am very glad I learned before my projects became larger.

Because small security habits become important very quickly once multiple apps start running on one VPS.

Final Thought

For non-coders entering the VPS world through AI-assisted development:

Buying the server is exciting.

Deploying the first app feels magical.

But learning basic firewall discipline early can save you from many future mistakes.

Not because your VPS will instantly get hacked otherwise.

But because learning:

which ports are open
which services are public
how traffic reaches your app

…is part of truly understanding how your production system works.