These are rules many servers need. You create each one with Create Firewall Rule under Service Management > Firewall, as shown in Enable the firewall for your VPS. Switch Enable on for each rule, and write in Comment what it is for.
Each new rule is added at the top of the list, and the first rule that matches decides. Create the rule that blocks everything else first, switched off, then your allow rules. Switch the blocking rule on last.
Allow SSH or Remote Desktop from your IP address
Type: in
Action: ACCEPT
Protocol: 6 Transmission Control Protocol
Destination Port: 22 for SSH, or 3389 for Remote Desktop
Source: your own public IP address
Comment: SSH from my IP
If your IP address changes, update Source before you connect. If you're locked out, switch the blocking rule off in the client area.
Allow a website
Type: in
Action: ACCEPT
Protocol: 6 Transmission Control Protocol
Destination Port: 80 in one rule and 443 in a second rule
Source: empty, so everyone can reach the site
Allow ping
Type: in
Action: ACCEPT
Protocol: 1 Internet Control Message Protocol
Source: empty
Ping lets you check that the server is reachable. Blocking it makes problems harder to find and doesn't make the server much safer.
Allow a VPN
Type: in
Action: ACCEPT
Protocol: 17 User Datagram Protocol
Destination Port: 1194 for OpenVPN or 51820 for WireGuard
Allow only the VPN you use. Every open port is one more door into the server.
Block everything else
Type: in
Action: DROP
Every other field empty
Comment: Block everything else
This rule must stay at the bottom of the list. For a VPN server, the finished list looks like this, from the top:
Allow SSH from your IP address
Allow OpenVPN or WireGuard
Allow ping
Block everything else