You don't need any firewall. All you need is to check `ss -ltunpr` and disable all services that are not listening on localhost, which is not usually many servi

You don't need any firewall. All you need is to check `ss -ltunpr` and disable all services that are not listening on localhost, which is not usually many services on minimalistic OS installation. And/or make sure [your own] internal services listen only on localhost addresses. So that just leaves keeping things uptodate, which is easy by subscribing to your distro's security mailing list, and updating when something relevant comes up. Which is rarely on a simple webhost VM.