Many beginners, upon receiving a VPS, immediately set up the environment and build a website. However, before that, something far more important is overlooked—has the VPS been properly secured?

An unprotected VPS placed on the public internet will be scanned by automated scripts within minutes—SSH brute-force attacks, port scans, and vulnerability probes are commonplace. Even worse, if the IP is blocked or hacked for any reason, business operations will be directly interrupted, and you might not even know how to change your IP.

This article will teach you from start to finish how to protect your VPS and what to do if you absolutely need to change your IP. It's completely beginner-friendly; just follow along.

I. VPS Security Protection: 5 Things You Must Do After Getting a New Machine

Before installing any software on your new VPS, complete the following tasks. Spending 20 minutes on security can save you countless headaches in the future.

1. Update the System—Patch Known Vulnerabilities

This is the simplest, yet most easily overlooked, step. A newly installed system may not have been updated for months or even longer, and may contain numerous known security vulnerabilities.

After logging into the VPS, first perform a system update:

Ubuntu/Debian systems:

sudo apt update

sudo apt upgrade -y

CentOS/RHEL systems:

sudo yum update -y

This step will update all packages to the latest versions and fix known security vulnerabilities. Do not skip this step.

2. Create a regular user and disable direct root login

Never use the root account directly for daily operations. Root privileges are too powerful; if compromised, the entire machine will be completely out of control.

Create a regular user (e.g., named `dev`):

adduser dev

usermod -aG sudo dev

Then switch to the new user to verify:

su ​​- dev

sudo whoami

If `root` is output, sudo privileges are configured successfully.

3. SSH key login—say goodbye to password brute-force attacks

Password login is the primary target of SSH brute-force attacks. Switching to key-based login fundamentally eliminates the possibility of brute-force attacks.

Generate a key pair on your local computer (Mac/Linux/WSL):

`ssh-keygen -t ed25519 -C "your email address"`

Press Enter repeatedly. The key is saved by default in `~/.ssh/id_ed25519`. Keep your private key file safe and do not share it.

Upload the public key to the server:

`ssh-copy-id -p 22 dev@your server IP`

After successfully testing key-based login, disable password-based login:

`sudo vim /etc/ssh/sshd_config`

Find and modify the following configurations:

`PasswordAuthentication no`

`PubkeyAuthentication yes`

`PermitRootLogin no`

Save and restart SSH:

`sudo systemctl restart sshd`

Important: Before closing the current SSH session, be sure to open a new terminal and test login using key-based login. Only close the old session after confirming a successful connection.

4. Change the Default SSH Port – Avoid 90% of Automated Scans

The default SSH port is 22, and almost all automated attack scripts only scan this port. Changing it to a higher-order port will directly filter out the vast majority of scans.

Edit the SSH configuration file:

sudo vim /etc/ssh/sshd_config

Find `#Port 22` and change it to your desired new port (e.g., 2222):

Port 2222

Do not restart the SSH service before allowing the new port in the firewall (see the next step for firewall configuration).

5. Configure the Firewall – Only Open Necessary Ports

The principle of the firewall is: by default, deny all inbound traffic and only open necessary ports.

Using UFW on Ubuntu/Debian:

First, allow the new SSH port (let's say 2222):

sudo ufw allow 2222/tcp

If you plan to deploy a web service later, open ports 80 and 443:

sudo ufw allow 80/tcp

sudo ufw allow 443/tcp

Enable the firewall:

sudo ufw enable

Using firewalld on CentOS/RHEL:

sudo firewall-cmd --zone=public --add-port=2222/tcp --permanent

sudo firewall-cmd --reload

After configuring the firewall, return to the previous step and restart the SSH service. Then test the connection using the new port.

6. (Optional but recommended) Install Fail2Ban to prevent brute-force attacks

Fail2Ban automatically monitors login logs and automatically blocks IPs that have repeatedly failed to log in.

sudo apt install fail2ban -y Ubuntu/Debian

sudo yum install fail2ban -y CentOS

Edit the configuration file:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

sudo vim /etc/fail2ban/jail.local

Find the `[sshd]` section and change `port` to your new SSH port:

[sshd]

enabled = true

port = 2222

Restart Fail2Ban:

sudo systemctl restart fail2ban

II. When do you need to change your IP?

With the above protections in place, your VPS is already largely secure. However, some situations cannot be resolved by protection alone—the IP itself may be the problem.

You should consider changing your IP in the following situations:

The IP is blacklisted: Due to the previous user's misconduct (spam, attacks, etc.), this IP has been marked by multiple blacklist databases. You encounter numerous obstacles when trying to register accounts and send emails.

IP blocked or inaccessible: Your IP is blocked in China due to certain network policies.

Suffering a continuous DDoS attack: Attack traffic targets your specific IP, and it may be attacked again even after being unblocked.

Business requires IP change: For example, you need to change to a native IP in a specific region to unlock streaming media or AI services.

IP has been contaminated: It has been used for illegal content, and the service provider requires you to change your IP to isolate the risk.

III. How to change your IP? Three mainstream methods

Method 1: Self-service change via the service provider's console (most recommended)

Most cloud service providers support self-service IP change via the console. This is the fastest and simplest way.

General Operation Steps:

1. Log in to your service provider's control panel and locate your VPS instance.

2. Find the network/IP management options—usually in the "Network," "IP Management," or "More Operations" menu on the instance details page.

3. Click "Change IP" or "Request a New IP"—the system will assign you a new public IP address.

4. Confirm the change—some service providers may require a small fee.

5. Wait for it to take effect—usually completed within 1-5 minutes.

The specific entry names may differ between service providers, but the logic is largely the same.

Method Two: Changing via Elastic IP Address (EIP)

If your service provider supports Elastic IP Addresses (EIPs), you can manage IPs more flexibly:

1. Request a new Elastic IP Address in the console.

2. Unbind the old public IP address of your current VPS (it will usually be released).

3. Bind the newly requested Elastic IP Address to the VPS instance.

The advantage of this method is that you can unbind and rebind at any time; changing your IP address is as flexible as changing a SIM card.

Method 3: Submit a Support Ticket to Contact Customer Service for Replacement

If the console does not offer a self-service replacement option, or if you encounter special circumstances, you can directly contact your service provider's technical support.

Steps:

1. Submit a support ticket, explaining the reason for needing to change the IP (e.g., IP blocked, attacked, etc.)

2. Provide relevant information—such as the current IP address and evidence of being blocked (e.g., screenshots of inaccessibility).

3. Confirm the cost—some service providers offer free initial replacements, but subsequent replacements may require payment.

4. Wait for processing—usually completed within minutes to hours.

IV. Precautions After Changing the IP

Changing the IP address doesn't mean everything is fine. There are a few things you must do:

Update DNS resolution: If your domain name points to the old IP, remember to log in to the domain management backend and update the A records to the new IP.

Check firewall and security groups: The new IP may require reconfiguring firewall rules or security group whitelists.

Update application configuration: If the old IP is hardcoded in the code or configuration files, remember to replace it completely.

Notify relevant parties: If any partners or users are accessing your service directly via your IP address, notify them in advance that the IP has changed.

Pay attention to the quality of the new IP: After changing, use an IP testing tool to check if the new IP is clean and not blacklisted.

V. Jtti's IP Management and Security Support

Jtti understands the importance of IP quality to user businesses. All Jtti cloud servers are equipped with clean, independent public IP addresses, with clearly traceable IP locations.

Regarding IP management, Jtti provides a flexible console interface, allowing users to self-manage IP viewing and changes. In special circumstances, Jtti's technical support team also provides ticketing and online service channels to help users quickly resolve IP-related issues.

Regarding security, Jtti encourages every user to complete basic security configurations after the server goes live—including SSH hardening and firewall settings. Jtti's cloud servers are equipped with dedicated bandwidth and enterprise-grade firewalls by default, providing basic protection at the network level and helping users build a strong security defense from the outset.

Visit the Jtti website now to choose a cloud server that suits your needs, starting with security configuration, and ensure your business runs on a reliable digital foundation.