The xyz.sh wrapper adds no telemetry and does not perform hidden actions. You can read the full source on the page or with curl -fsSL xyz.sh/ .sh before running it. Piping a remote script to bash is still a risk — review the source first. Confirm the detected SSH port before enabling the firewall, or you may be locked out. The UFW path runs ufw --force reset, which clears existing UFW rules before applying this policy.

Which operating systems are supported?

Declared support: Debian, Ubuntu, CentOS, Rocky Linux, and AlmaLinux. The script detects the distribution and asks before continuing on an unrecognized OS. Syntax was checked with bash -n and ShellCheck; installer scripts have not been end-to-end verified on every listed distribution.

Yes. Run it as root or via sudo bash. The script exits with a message if it is not root.

How do I uninstall or disable it?

curl -fsSL xyz.sh/firewall | bash -s -- --disable. Use --status to inspect current rules.

Which ports are allowed by default?

The detected SSH port (from sshd_config, else 22) is always allowed first. By default 80/tcp and 443/tcp are also allowed. Use --ssh-only for SSH alone, or --allow 8443 to add a port.

VPS Firewall Tutorial (UFW / firewalld, SSH Allowed First)

This tutorial shows how to apply a basic host firewall with xyz.sh/firewall (alias ufw). Confirm the detected SSH port before enabling it, or you may lose access.

What it does

Debian/Ubuntu use UFW; CentOS/Rocky/AlmaLinux use firewalld. The SSH port is detected from sshd_config (or default 22, or the current SSH session) and allowed first, then 80/443 or any --allow ports. Incoming traffic is denied by default; outgoing is allowed.

Warning: the UFW path runs ufw --force reset, which clears existing UFW rules before applying this policy.

Commands

Default policy: curl -fsSL xyz.sh/firewall | bash

SSH only: curl -fsSL xyz.sh/firewall | bash -s -- --ssh-only

Extra port: bash -s -- --allow 8443 Inspect: --status Disable: --disable

The alias curl -fsSL xyz.sh/ufw | bash runs the same script.