Appearance

Firewall Setup ​

DNS points players at NeoProtect, but your backend can still be reached directly if someone learns its IP. A firewall closes that gap: it blocks all incoming traffic except from NeoProtect, so attackers cannot bypass your protection.

This guide covers three ways to do it — UFW, iptables, or our automatic setup script. Pick whichever you are comfortable with.

1. Using UFW ​

Step 1: Install UFW ​

bash
sudo apt update
sudo apt install ufw

Step 2: Block all incoming traffic ​

bash
sudo ufw default deny incoming

Step 3: Allow NeoProtect IPs ​

Get the current NeoProtect IP list, then run this once for each IP:

bash
sudo ufw allow from <ip>

Step 4: Allow SSH connections ​

So you do not lock yourself out of your own server:

bash
sudo ufw allow ssh

Step 5: Enable UFW ​

bash
sudo ufw enable

2. Using iptables ​

Step 1: Block all incoming traffic ​

bash
sudo iptables -P INPUT DROP

Step 2: Allow NeoProtect IPs ​

Get the current NeoProtect IP list, then run this once for each IP:

bash
sudo iptables -A INPUT -s <ip> -j ACCEPT

Step 3: Allow SSH connections ​

So you do not lock yourself out of your own server:

bash
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Step 4: Save the iptables rules ​

bash
sudo iptables-save > /etc/iptables/rules.v4

3. Using the NeoProtect script ​

To skip the manual steps, download and run our script. It configures your firewall to allow only NeoProtect IPs for you:

bash
curl -sSf https://neoprotect.net/firewall | bash

4. Verify your firewall ​

After setup, check that the rules are active:

  • UFW: sudo ufw status
  • iptables: sudo iptables -L

Confirm that only NeoProtect IPs are allowed, and that your own IP can still reach SSH.