Hetzner Cloud firewall setup for a web server (2026)

Master the Hetzner Cloud firewall setup for a web server in 2026. Secure your server now. Read our expert security guide!

Futuristic server room with a holographic firewall shield filtering data streams.

Quick Start: Essential Firewall Rules for Web Servers

A Hetzner Cloud firewall protects your web server from unwanted access. It acts like a security guard, checking who can connect to your server. Setting up firewall rules correctly keeps your website safe while allowing visitors to see your content.

Minimum Required Ports for Web Hosting

Your web server needs three main ports open:

  • Port 22 (SSH): For remote server management
  • Port 80 (HTTP): For regular website traffic
  • Port 443 (HTTPS): For secure website traffic

Default Security Posture Explained

Hetzner Cloud firewalls use a “deny by default” approach. This means all traffic is blocked unless you create a rule to allow it. This is the safest way to protect your server.

Common Mistakes to Avoid

  • Forgetting to allow SSH access before applying the firewall
  • Opening too many ports unnecessarily
  • Not testing the firewall after setup
  • Blocking your own IP address

Prerequisites Before Setting Up Your Hetzner Cloud Firewall

Required Access and Permissions

Before you start, make sure you have:

  • A Hetzner Cloud account
  • At least one running server
  • Admin access to the Hetzner Console
  • Your server’s root password or SSH key

Identifying Your Server’s IP Addresses

Find your server’s IP address in the Hetzner Console:

  1. Log in to your Hetzner Cloud account
  2. Click on “Servers” in the left menu
  3. Select your server from the list
  4. Copy the IPv4 address (looks like 123.45.67.89)
  5. Note the IPv6 address if your server uses it

Documenting Your Web Server’s Services

Make a list of services your server runs:

Service Port Purpose
SSH 22 Remote management
HTTP 80 Website access
HTTPS 443 Secure website access

Preparing Your Administrator IP Address

Find your current IP address by visiting whatismyip.com. Write this down. You will need it to allow SSH access only from your computer.

Understanding Hetzner Cloud Firewall Basics

How Hetzner Cloud Firewalls Work

A Hetzner Cloud firewall sits between the internet and your server. It checks every connection request against your rules. If a connection matches an allow rule, it passes through. If not, it gets blocked.

Inbound vs Outbound Traffic Rules

Inbound rules control traffic coming TO your server from the internet. These are the most important for security.

Outbound rules control traffic going FROM your server to the internet. By default, all outbound traffic is allowed.

Stateful Filtering and Connection Tracking

Hetzner firewalls are “stateful.” This means if you allow a connection in, the response traffic automatically gets through. You don’t need separate rules for responses.

Cloud Firewall vs Host Firewall (UFW/nftables)

The Hetzner Cloud firewall works at the network level, before traffic reaches your server. Host firewalls like UFW work inside the server. You can use both for extra security, but the cloud firewall is easier to manage.

Step-by-Step: Setting Up Hetzner Cloud Firewall via Console

Creating a New Firewall in Hetzner Console

  1. Log in to your Hetzner Cloud Console
  2. Click “Security” in the left menu, then “Firewalls”
  3. Click the “Create Firewall” button
  4. Enter a name like “web-server-firewall”
  5. Click “Create & add rules”

Configuring Inbound Rules for Web Traffic

Step 1: Allowing SSH Access (Port 22)

  1. Click “Add Rule” under Inbound Rules
  2. Set Protocol to “TCP”
  3. Set Port to “22”
  4. In the Source field, enter your IP address (from whatismyip.com)
  5. Example: 203.0.113.50/32 (the /32 means just this one IP)
  6. Click “Apply” to save the rule

Important: Always add SSH rule first and test it before applying the firewall to your server.

Step 2: Allowing HTTP Traffic (Port 80)

  1. Click “Add Rule” again
  2. Set Protocol to “TCP”
  3. Set Port to “80”
  4. In the Source field, enter “0.0.0.0/0” (allows all IPv4 addresses)
  5. Click “Apply”

Step 3: Allowing HTTPS Traffic (Port 443)

  1. Click “Add Rule” one more time
  2. Set Protocol to “TCP”
  3. Set Port to “443”
  4. In the Source field, enter “0.0.0.0/0”
  5. Click “Apply”

Configuring Outbound Rules

For most web servers, the default outbound rules work fine. They allow your server to:

  • Download updates
  • Send emails
  • Connect to external APIs

Leave outbound rules as “Allow all” unless you have specific security requirements.

Applying the Firewall to Your Web Server

  1. Go to the “Apply to” section
  2. Click “Select Resources”
  3. Choose your server from the list
  4. Click “Apply Firewall”

Warning: Before clicking this button, make sure you have a backup SSH session open (see next section).

Testing Connectivity After Application

  1. Open a new terminal window
  2. Try to SSH into your server: ssh root@your-server-ip
  3. If it works, your SSH rule is correct
  4. Open a browser and visit your website
  5. If it loads, HTTP/HTTPS rules are working

Preventing SSH Lockout: Critical Safety Procedures

Why SSH Lockout Happens

SSH lockout occurs when your firewall blocks SSH access. This can happen if you:

  • Forget to add an SSH rule
  • Enter the wrong IP address in the SSH rule
  • Your IP address changes and you don’t update the rule

Pre-Setup Safety Checklist

Before applying any firewall, check these items:

  1. SSH rule is added and correct
  2. Your IP address is correct in the SSH rule
  3. You have a backup way to access the server (Hetzner Console)
  4. A backup SSH session is open

Keeping a Backup SSH Session Open

  1. Open two terminal windows
  2. SSH into your server in both windows
  3. Apply the firewall in the Hetzner Console
  4. Test SSH in the first window
  5. If it fails, use the second window to fix the firewall rules
  6. Only close the backup session after confirming everything works

Emergency Recovery via Hetzner Console

If you get locked out:

  1. Go to Hetzner Console
  2. Click on your server
  3. Click “Open Console” (this gives you direct access)
  4. Log in with your credentials
  5. Edit the firewall rules to fix the SSH access

Using Temporary SSH Rules Safely

For testing, you can temporarily allow SSH from anywhere:

  1. Add SSH rule with source “0.0.0.0/0”
  2. Test your firewall setup
  3. Immediately change it back to your specific IP
  4. Never leave SSH open to the world

Testing and Validating Your Hetzner Cloud Firewall Setup

Testing SSH Access from Different Networks

Test SSH from multiple locations:

  • Your home network
  • A mobile hotspot
  • A friend’s network

If SSH works from your allowed IP but not others, your firewall is working correctly.

Verifying HTTP and HTTPS Connectivity

  1. Open a browser
  2. Visit http://your-server-ip
  3. Visit https://your-server-ip
  4. Both should load your website

Testing Blocked Ports and IPs

Verify that blocked traffic is actually blocked:

  1. Try to connect to a blocked port: telnet your-server-ip 3306
  2. It should timeout or refuse connection
  3. Try SSH from an unauthorized IP
  4. It should be rejected

IPv4 and IPv6 Validation

If your server has IPv6:

  • Add IPv6 rules (::/0 for HTTP/HTTPS)
  • Test with IPv6 addresses
  • Use tools like ipv6-test.com to verify

Using Online Port Scanning Tools

Use these free tools to check your firewall:

  • yougetsignal.com/tools/open-ports
  • nmap.org (for advanced users)
  • shodan.io (to see what’s exposed)

Troubleshooting Common Hetzner Cloud Firewall Issues

Website Not Loading After Firewall Setup

Problem: Website shows “connection refused” or times out.

Solution:

  1. Check that port 80 and 443 rules exist
  2. Verify the source is “0.0.0.0/0” for web traffic
  3. Make sure the firewall is applied to your server
  4. Check that your web server software is running

SSH Connection Refused

Problem: Cannot SSH into server after applying firewall.

Solution:

  1. Use Hetzner Console to access the server directly
  2. Check SSH rule: protocol TCP, port 22
  3. Verify your IP address is correct in the source field
  4. Check if your IP changed (visit whatismyip.com from your computer)

HTTPS Certificate Issues

Problem: Browser shows certificate error after firewall setup.

Solution:

  1. This is usually not a firewall issue
  2. Check that port 443 is open
  3. Verify your SSL certificate is valid
  4. Make sure your domain points to the correct IP

IPv6 Traffic Not Working

Problem: Website works on IPv4 but not IPv6.

Solution:

  1. Add IPv6 rules for ports 80 and 443
  2. Use “::/0” as the source for IPv6 rules
  3. Test with an IPv6-enabled network

Database Connection Failures

Problem: Website cannot connect to database.

Solution:

  1. If database is on the same server, this is not a firewall issue
  2. If database is on a different server, allow port 3306 (MySQL) or 5432 (PostgreSQL)
  3. Only allow database connections from your web server’s IP

DNS Resolution Problems

Problem: Server cannot resolve domain names.

Solution:

  1. Check outbound rules allow DNS traffic (port 53 UDP/TCP)
  2. By default, all outbound traffic is allowed
  3. If you restricted outbound, add DNS rules

FAQ: Common Questions About Hetzner Cloud Firewall for Web Servers

Do I Need Both Hetzner Firewall and UFW?

You can use both for extra security, but it’s not required. The Hetzner Cloud firewall is easier to manage and works before traffic reaches your server. UFW adds another layer inside the server. For most users, the Hetzner firewall alone is sufficient.

How Do I Allow FTP Access?

FTP is not secure. Use SFTP instead, which works over SSH (port 22). If you must use FTP:

  • Add TCP port 21 for FTP control
  • Add TCP ports 49152-65534 for passive mode
  • Only allow from specific IP addresses

Can I Use Hetzner Firewall with Cloudflare?

Yes. When using Cloudflare, allow HTTP/HTTPS traffic from Cloudflare’s IP ranges. You can find these at cloudflare.com/ips. This ensures only Cloudflare can reach your server directly.

What Happens If I Block ICMP Traffic?

ICMP is used for ping and network diagnostics. Blocking it means:

  • Ping commands won’t work
  • Some network tools can’t check if your server is online
  • It doesn’t affect website or SSH access

For most web servers, you can safely block ICMP or allow it only from specific IPs.

How Do I Update Firewall Rules Without Downtime?

Follow these steps:

  1. Keep a backup SSH session open
  2. Make your changes in the Hetzner Console
  3. Click “Apply” to save changes
  4. Test immediately in the backup session
  5. If something breaks, use the backup session to fix it

Conclusion: Securing Your Web Server with Hetzner Cloud Firewall

Setting up a Hetzner Cloud firewall is essential for protecting your web server. By following this guide, you’ve learned how to:

  • Create firewall rules for SSH, HTTP, and HTTPS
  • Apply the firewall safely without getting locked out
  • Test your setup to ensure it works correctly
  • Troubleshoot common problems

Key takeaways:

  1. Always allow SSH before applying the firewall
  2. Keep a backup SSH session open during setup
  3. Only open the ports you need
  4. Restrict SSH access to your IP address only
  5. Test thoroughly after making changes

Next steps:

  • Set up automatic security updates on your server
  • Consider using SSH keys instead of passwords
  • Monitor your server logs for suspicious activity
  • Review your firewall rules monthly
  • Learn about fail2ban for additional SSH protection

Your web server is now protected by a properly configured Hetzner Cloud firewall. Regular maintenance and monitoring will keep it secure as threats evolve.