Running a VPN or proxy service on a server comes with a real responsibility: as the owner of the IP, you’re on the hook for anything your users do through it. This guide covers two ways to reduce abuse complaints and lower the risk of a suspension, on both Linux (UFW) and Windows (Windows Defender Firewall).
화이트리스팅 (strict) blocks everything by default and only allows the specific traffic your server needs. 블랙리스팅 (lenient) allows everything by default and blocks only specific known-abuse ports and services. Whitelisting is stricter and safer, blacklisting is easier to set up but offers weaker protection.
This is directly connected to how Cloudzy handles abuse: repeat or unresolved abuse reports can lead to a suspension. See AUP 위반으로 인한 이용 정지 for how that process works, this guide is how to avoid becoming a repeat offender in the first place.
It’s your responsibility to keep your VPS secure. If you’re not able to keep it secure, we recommend not sharing your VPN with others, to avoid the risk of unauthorized or abusive use.
Linux (UFW): Whitelisting
Strict mode. Block everything in and out by default, then explicitly allow only the traffic your server and its VPN or proxy users actually need. This is the safer, more restrictive setup, it minimizes abuse potential but requires opening every port manually.
1. Install UFW
sudo apt install ufw2. Disable UFW before making changes
sudo ufw disableThe next commands change the default policy. If UFW were active while doing this, you could get disconnected from the server mid-change, before the SSH-allow rule is in place.
3. Set default policy to deny everything
sudo ufw default deny incoming
sudo ufw default deny outgoingUnless a rule explicitly allows a connection, it’s dropped. Both directions are blocked at this point, nothing works yet, including your own SSH access.
4. Allow yourself back in via SSH
sudo ufw allow in 22/tcp comment "Allow SSH in"Since incoming traffic is now blocked, SSH needs to be explicitly re-allowed so you don’t lock yourself out. If you use a custom SSH port, use that port number instead of 22.
5. Block outgoing SSH to prevent brute-force abuse
sudo ufw deny out 22/tcp comment "Block outgoing SSH brute force"This blocks outbound connections to port 22. Neither you nor your VPN users can SSH out to other servers from this machine, this is one of the most common sources of abuse complaints (SSH brute-force attacks launched from your IP).
6. Allow your VPN/proxy port inbound
sudo ufw allow in 1194/tcp comment "OpenVPN port for users"
sudo ufw allow in 1194/udp comment "OpenVPN port for users"Your VPN users need to connect to your server on whatever port your VPN software uses. This example uses OpenVPN’s default (1194), replace it with the correct port for your setup. Without this rule, users can’t connect to the VPN at all.
7. Allow outbound web traffic
sudo ufw allow out 80/tcp comment "HTTP"
sudo ufw allow out 443/tcp comment "HTTPS"
sudo ufw allow out 443/udp comment "HTTP3"Port 80 covers plain HTTP, 443/tcp covers HTTPS, and 443/udp covers HTTP3 (QUIC), used by many modern sites and apps.
8. Allow outbound DNS
sudo ufw allow out 53 comment "DNS resolution"Easy to forget, and required. Without outbound port 53, domain names can’t be resolved to IP addresses, users would only be able to reach sites by raw IP, which breaks almost everything in practice.
9. Enable the firewall
sudo ufw enableSince the SSH-in rule already exists, enabling UFW won’t disconnect you. From this point on, only the traffic explicitly allowed above will pass.
Optional: app-specific ports
Different apps use different ports beyond 80/443. Check each app’s own network documentation and only open what your users actually need, the fewer open ports, the lower the abuse risk. For example, Git:
sudo ufw allow out 9418/tcp comment "Git"Linux (UFW): Blacklisting
Lenient mode. Allow everything outbound by default, and only block specific known-abuse ports and services. Easier to set up and more flexible for users, but weaker protection, it only stops the abuse patterns you’ve explicitly blocked, not abuse in general. Use this only if you trust your users or need broad compatibility.
1. Install UFW
sudo apt install ufw2. Disable UFW before making changes
sudo ufw disableSame reasoning as before, avoid disconnecting yourself mid-configuration.
3. Block incoming by default, allow outgoing by default
sudo ufw default deny incoming
sudo ufw default allow outgoingThis is the key difference from whitelisting: outgoing traffic is allowed by default, meaning your users can connect out to anything unless you specifically block it.
4. Allow yourself in via SSH
sudo ufw allow in 22/tcp comment "Allow SSH in"Without this, you’d lock yourself out once the firewall is enabled.
5. Block outgoing SSH to reduce brute-force abuse reports
sudo ufw deny out 22/tcp comment "Block outgoing SSH brute force"Even in lenient mode, this specific block is worth keeping. Outbound SSH brute-forcing is one of the most common reasons servers get reported and suspended.
6. Block common BitTorrent ports
sudo ufw deny out 6881:6889/tcp comment "Block BitTorrent"
sudo ufw deny out 6881:6889/udp comment "Block BitTorrent"BitTorrent traffic, illegal file-sharing in particular, is another frequent source of abuse complaints. This blocks the standard BitTorrent port range (6881 to 6889) for both TCP and UDP. This only blocks the default range, some torrent clients can be configured to use other ports, so this isn’t a complete block, just a strong reduction.
7. Enable the firewall
sudo ufw enable참고: If you get disconnected, reconnect via VNC through your control panel, then run
sudo ufw disableto undo the changes and start over.
Windows (GUI): Whitelisting
Same strict-mode logic as the Linux whitelisting section above, done through Windows Defender Firewall with Advanced Security instead of the command line. Go to Control Panel → Windows Defender Firewall → Advanced settings.
1. Allow RDP inbound first
Before blocking anything, make sure you won’t lock yourself out:
- 이동 Inbound Rules → New Rule
- Rule type: Port → Next
- Protocol: TCP, specific local port: 3389 → Next
- 연결 허용 → Next
- Check all profiles (Domain, Private, Public) → Next
- Name it “Allow RDP” → Finish
This step must happen before you switch the default policy to Block, or you’ll be locked out of the server entirely (recoverable only via VNC).
2. Set the default policy to block everything
- 우클릭 Windows Defender Firewall with Advanced Security (Local) at the top of the left panel → Properties
- For each profile tab (Domain / Private / Public): set Inbound connections to Block, and Outbound connections to Block
- Click Apply → OK
From this point, nothing passes except your RDP rule from Step 1.
3. Allow your VPN/proxy port inbound
Repeat the New Rule steps from Step 1, but for your VPN’s port instead of 3389: Inbound Rules → New Rule → Port → TCP (create a separate rule for UDP if your VPN uses it too) → enter your VPN port (e.g. 1194) → Allow the connection → Finish. Without this, VPN users can’t reach the server at all.
4. Allow outbound web traffic and DNS
아래 Outbound Rules → New Rule, repeat for each of the following:
- TCP port 80 → Allow → name “Allow HTTP”
- TCP port 443 → Allow → name “Allow HTTPS”
- UDP port 443 → Allow → name “Allow HTTP3”
- UDP port 53 → Allow → name “Allow DNS”
참고: The DNS rule (UDP 53) is required, without it domain names won’t resolve for users.
5. Optional: block outbound RDP
To reduce the risk of your server being used for RDP brute-force attacks against other machines: Outbound Rule → Port → TCP → 3389 → Block the connection → Finish.
Windows (GUI): Blacklisting
Same lenient-mode logic as the Linux blacklisting section, allow outbound traffic by default, and only block specific known-abuse ports using the GUI’s Block rule type.
1. Allow RDP inbound
Same as the whitelisting section, set this up first so you don’t get locked out: Inbound Rules → New Rule → Port → TCP → 3389 → Allow the connection → all profiles → name “Allow RDP” → Finish.
2. Set inbound to Block, leave outbound as Allow
- 우클릭 Windows Defender Firewall with Advanced Security (Local) → Properties
- For each profile tab: set Inbound connections to Block, keep Outbound connections as Allow
- Apply → OK
Unlike whitelisting mode, outbound traffic is left open here, your users can reach anything outbound unless specifically blocked below.
3. Block BitTorrent outbound
Outbound Rules → New Rule → Port → TCP → range 6881-6889 → Block the connection → name “Block BitTorrent TCP” → Finish. Repeat the same steps for UDP, same port range → name “Block BitTorrent UDP”.
This blocks the standard BitTorrent range outbound, reducing (though not eliminating) file-sharing abuse from the server.
참고: When Outbound is fully blocked (Whitelisting mode on Windows), Windows Update, license activation, and some built-in Windows services may stop working unless explicitly allowed.
Menu naming may vary slightly by Windows version, the general steps and logic are correct across Windows Server versions, but exact wording may differ a little depending on the build (for example, some older versions show “Windows Firewall” instead of “Windows Defender Firewall”).
참고: If you get disconnected while configuring either OS, you can regain access via VNC through the control panel and undo the firewall changes from there.
Related
Reducing abuse complaints is one part of avoiding a suspension. See AUP 위반으로 인한 이용 정지 for how Cloudzy handles reported abuse, and Cloudzy 이용 정지 유형 for the full picture.
Questions about your specific setup? Open a support ticket.