diff --git a/server-setup/cloud-init/cloud-init.yml b/server-setup/cloud-init/cloud-init.yml
index ba2e5e3..8bfc03c 100644
--- a/server-setup/cloud-init/cloud-init.yml
+++ b/server-setup/cloud-init/cloud-init.yml
@@ -166,4 +166,15 @@ runcmd:
   - chown -R eberkheev:eberkheev /home/eberkheev/3x-ui
   - chown -R eberkheev:eberkheev /home/eberkheev/cert
   - chown eberkheev:eberkheev /home/eberkheev/update.sh
+  - ufw default deny incoming
+  - ufw default allow outgoing
+  - ufw allow 22/tcp
+  - ufw allow 80/tcp
+  - ufw allow 443/tcp
+  - ufw allow 10001/tcp
+  - ufw allow 10003/tcp
+  - ufw allow 10022/tcp
+  - ufw allow 10080/tcp
+  - ufw allow 10443/tcp
+  - ufw --force enable
   - docker pull ghcr.io/mhsanaei/3x-ui:latest
diff --git a/server-setup/manual-setup/setup.sh b/server-setup/manual-setup/setup.sh
index a6616a2..31a9ff9 100755
--- a/server-setup/manual-setup/setup.sh
+++ b/server-setup/manual-setup/setup.sh
@@ -268,7 +268,21 @@ UPDATEEOF
 
 chown "$NEW_USER:$NEW_USER" "$USER_HOME/update.sh"
 
-echo "=== [8/8] Запуск 3x-ui ==="
+echo "=== [8/9] Настройка файрвола ==="
+ufw default deny incoming
+ufw default allow outgoing
+ufw allow 22/tcp        # tunnel: gitea SSH
+ufw allow 80/tcp        # tunnel: HTTP
+ufw allow 443/tcp       # tunnel: HTTPS
+ufw allow 10001/tcp     # SSH
+ufw allow 10003/tcp     # vmess VPN
+ufw allow 10022/tcp     # bridge: gitea SSH (Reality VLESS)
+ufw allow 10080/tcp     # bridge: HTTP (Reality VLESS)
+ufw allow 10443/tcp     # bridge: HTTPS (Reality VLESS)
+ufw --force enable
+echo "UFW настроен"
+
+echo "=== [9/9] Запуск 3x-ui ==="
 cd "$XUI_DIR"
 docker pull ghcr.io/mhsanaei/3x-ui:latest
 docker run -d \
@@ -287,9 +301,10 @@ echo "============================================"
 echo "  Сервер настроен!"
 echo "============================================"
 echo ""
-echo "  SSH:   порт $SSH_PORT, пользователь $NEW_USER"
-echo "  3x-ui: запущен в Docker (network_mode: host)"
-echo "  Панель: https://<IP>:10002 (или порт из x-ui.db)"
+echo "  SSH:      порт $SSH_PORT, пользователь $NEW_USER"
+echo "  3x-ui:   запущен в Docker (network_mode: host)"
+echo "  Панель:  https://<IP>:10002 (или порт из x-ui.db)"
+echo "  UFW:     22, 80, 443, 10001, 10003, 10022, 10080, 10443"
 echo ""
 echo "  Для обновления: bash ~/update.sh"
 echo "  Для проверки:   docker ps"