The firewall in the client area filters traffic before it reaches your VPS. A new VPS has no rules, so the firewall blocks nothing. A rule that allows a port doesn't block anything else either: to keep other traffic out, you add a rule that blocks it.
Before you start, check that noVNC Console under Service Management opens your server's screen. It keeps working even if a rule blocks SSH or Remote Desktop.
How the rule list works
Rules are checked from the top of the list, starting at Position 0.
The first rule that matches the traffic decides what happens. The rules below it are not checked.
Each new rule is added at the top, at position 0. To move a rule, drag it by the arrows next to its position.
A new rule starts switched off. It works only when Enable is on.
A change takes effect within a minute.
An example with ping is in Firewall rule order.
How to allow only the ports you use
Create the blocking rule first, switched off, and then the rules that allow your ports. Each new rule lands above the blocking rule, so it is checked first.
Step 1: Open your server's page.
Go to My servers and click Manage next to the server.
Step 2: Open the firewall.
In the menu on the left, under Service Management, click Firewall.
Step 3: Create the blocking rule, switched off.
Click Create Firewall Rule. Set Type to in and Action to DROP or REJECT. Leave the other fields empty and Enable off, write Block everything else in Comment and click Confirm.
DROP ignores the traffic, so the other side waits until it gives up. REJECT refuses it at once.
Step 4: Allow SSH or Remote Desktop.
Click Create Firewall Rule again. Set Type to in, Action to ACCEPT, Protocol to 6 Transmission Control Protocol and Destination Port to 22 for SSH, or 3389 for Remote Desktop on Windows. To allow only yourself, put your own IP address in Source. Switch Enable on and click Confirm.
Step 5: Allow the other ports you use.
Repeat step 4 for each service, for example ports 80 and 443 for a website. Write in Comment what each rule is for, because the list doesn't show ports.
Step 6: Switch the blocking rule on.
Check that your allow rules are above Block everything else, then switch its Enable on in the list.
Open a new SSH or Remote Desktop connection to check that it works, before you close the one you have.
Keep the blocking rule at the bottom of the list. If it sits above your SSH or Remote Desktop rule, you can't connect to the server.
The fields in a rule
Type: in for traffic coming to the server, out for traffic leaving it.
Action: ACCEPT lets the traffic through, DROP ignores it, REJECT refuses it.
Interface: keep net0.
Source: the IP address the traffic comes from. Leave it empty for everyone.
Destination: leave it empty if your VPS has one IP address.
Protocol: 6 Transmission Control Protocol for most services, 17 User Datagram Protocol for some VPNs and games, 1 Internet Control Message Protocol for ping.
Destination Port: the port on your server, for example 22.
Macro: a ready setting for a common service. It fills in the protocol and the port.
Comment: what the rule is for.
Ready examples are in Common firewall rules for a VPS.
How to change or switch off a rule
To switch a rule off without deleting it, use its Enable switch in the list.
To change a rule, click the edit icon on the right of the rule.
If a rule locks you out of SSH or Remote Desktop, the client area still works: switch the rule off or delete it. noVNC Console keeps working too.