Setting up your first server in Vietnam: a walkthrough for overseas teams

When your project involves Vietnamese users, partners, or compliance, the right move is to run your infrastructure from inside the country. A physical server or virtual private server (VPS) located in a Vietnam datacenter gives you domestic routing, a local IPv4, and low latency to users inside Vietnam. This article walks every step from ordering to a running, hardened server, written for teams who are not physically in Vietnam but need to operate there.

• Target audience: overseas developers, DevOps, IT managers.
• Environment: Ubuntu 24.04 LTS (Linux) and Windows Server 2022 (Windows) on KVM virtualization.
• Assumes: you can accept payments via PayPal, wire, or card; you have a domain name ready if required.

从下单、SSH或RDP登录到基础加固，一次走完整个流程。

From ordering to logging in over SSH or RDP and basic hardening, the whole flow in one pass.

Prerequisites

• A credit card, PayPal account, or ability to make an international wire transfer.
• Basic familiarity with SSH (Linux) or Remote Desktop (Windows).
• A domain name if you plan to serve web traffic (DNS will point to your Vietnam IPv4).
• Root or Administrator access on the server (this is standard with KVM VPS).

Why locate a server in Vietnam?

Vietnam has its own internet backbone operated by major telecoms: Viettel (military-owned, largest ISP and datacenter operator), VNPT (state-owned telecom, extensive domestic network), FPT Telecom (largest private ISP, popular with businesses), and CMC Telecom (enterprise-focused, Tier 3 datacenters). These providers interconnect domestically, meaning traffic between a server inside Vietnam and a user inside Vietnam stays local. That avoids the latency of routing through Hong Kong, Singapore, or the US.

Another critical factor is the IPv4 address. A Vietnam-allocated IPv4 is recognised by Vietnamese services, banks, government portals, and CDN nodes as local. This matters for geo-restricted APIs, localisation settings, and compliance under decrees like Decree 53 (data residency for certain sectors). For overseas teams serving Vietnamese users, this is often the simplest way to get a local digital presence without incorporating a company in Vietnam.

Every Linux VPS or Windows VPS from thueVPS comes with NVMe storage, a dedicated Vietnam IPv4, and full root or Administrator access.Domestic bandwidth is 100 Mbps on a 1 Gbps port, with unlimited traffic and no data cap. This is local infrastructure designed for workloads that touch Vietnam.

Step 1, Ordering your server

Choose a plan that fits your workload. For a first server, a good starting point is the VNLite plan: 1 vCPU, 2 GB RAM, 20 GB NVMe storage, one dedicated IPv4, and unlimited traffic. This runs a small web service, a VPN endpoint, or an n8n automation instance comfortably. Scale up to VNx2 (2 vCPU / 4 GB / 50 GB) or VNx4 (4 vCPU / 8 GB / 100 GB) for heavier applications like a self-hosted GitLab or a production database.

During ordering you choose the operating system. Select Ubuntu 24.04 LTS (64-bit) for a typical Linux setup, or use Windows Server 2022 if your team runs .NET apps or requires a GUI. The provider provisions the server with all resources dedicated (KVM virtualization), no overselling.

Payment: Most Vietnam providers accept PayPal, international credit cards, and bank transfers. The billing cycle is monthly, no long-term contract. After payment, you receive an email with the server IP, root password, and control panel login.

Step 2, Connecting for the first time

Linux (Ubuntu 24.04) via SSH

Open a terminal on your machine. Use the IP address from the provision email:

ssh [email protected]

When prompted, enter the root password (paste it, nothing will show, press Enter). You are now logged in as the root user.

First action: Change the root password immediately:

passwd

Choose a strong password, at least 16 characters with mixed case, numbers, and symbols.

Windows Server via RDP

On your local machine, open Remote Desktop Connection (search "mstsc" on Windows, or use "Microsoft Remote Desktop" on macOS). Enter the server IP, and when prompted, use Administrator as the username and the password from the email.

First action: Change the Administrator password via Computer Management → Local Users and Groups → Users or with the command:

net user Administrator *

Enter the new password twice.

Step 3, Basic hardening (Linux)

A fresh server is a blank canvas, and also a target. Complete these steps before any deployment.

Create a non-root sudo user

adduser deployer
usermod -aG sudo deployer

Log out (exit) and log in as deployer:

ssh [email protected]

Disable root login over SSH

Edit the SSH daemon config:

sudo nano /etc/ssh/sshd_config

Set these lines:

PermitRootLogin no
PasswordAuthentication no

Before disabling password auth, ensure your SSH public key is installed:

mkdir -p ~/.ssh
echo "your-public-key-content" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
chmod 700 ~/.ssh

Restart SSH:

sudo systemctl restart ssh

Set up a firewall

Ubuntu 24.04 ships with UFW (Uncomplicated Firewall). Allow SSH and HTTP/HTTPS before enabling:

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Verify:

sudo ufw status verbose

Install fail2ban

Fail2ban monitors authentication logs and bans IPs after repeated failures:

sudo apt update && sudo apt install fail2ban -y
sudo systemctl enable --now fail2ban

Set the hostname

Give the server a meaningful name:

sudo hostnamectl set-hostname vietnam-server-01
echo "127.0.1.1 vietnam-server-01" | sudo tee -a /etc/hosts

Step 4, Basic hardening (Windows Server)

Windows Firewall

Open Windows Defender Firewall from the control panel. Ensure port 3389 (RDP) is open, and block all other inbound ports unless your application needs them. To restrict RDP to a known IP range, create a custom inbound rule on port 3389 and set the scope to your office or VPN IP.

Enable Network Level Authentication (NLA)

Open System Properties → Remote. Check "Allow connections only from computers running Remote Desktop with Network Level Authentication". This prevents brute-force attacks from clients that don't pass NLA.

Install security updates

Run Windows Update (Settings → Update & Security → Check for updates) and install all pending patches. Reboot if required.

Create a non-Administrator user

Use the command as Administrator:

net user appuser StrongPassword123! /add
net localgroup "Remote Desktop Users" appuser /add

Use this account for daily work instead of the Administrator account.

Step 5, Deploying a simple web service (optional quickstart)

On Ubuntu, install Nginx to serve a static page as a smoke test:

sudo apt install nginx -y
sudo systemctl enable --now nginx

Create a test page:

echo "<h1>Hello from Vietnam!</h1>" | sudo tee /var/www/html/index.html

Open your browser and visit http://203.113.x.x, you should see the heading. This confirms the firewall allows traffic and the web server is running.

Step 6, Setting up a monitoring baseline

Before going live, record the baseline performance of your server. On Linux, install a lightweight metric collector:

sudo apt install htop nload -y

Run htop to see CPU/memory usage; run nload to see real-time network throughput. Note what the idle resource consumption looks like, this helps identify anomalies later.

For persistent monitoring, consider deploying Netdata (one command):

bash <(curl -Ss https://my-netdata.io/kickstart.sh)

It runs on port 19999 and gives you a full dashboard, CPU, RAM, disk I/O, network per interface. Netdata consumes very little resources and runs out of the box.

Troubleshooting common issues

I cannot connect via SSH

Check three things: (1) the server IP is correct in your SSH command, (2) the firewall on your local network does not block outbound SSH (port 22), (3) the server's UFW/firewalld is not blocking SSH, if you just enabled UFW, re-check with ufw status. If all else fails, reboot the server from the provider's control panel, this clears transient kernel-level blocks.

RDP connection fails on Windows Server

Ensure port 3389 is allowed in Windows Firewall. From another Windows machine, test with Test-NetConnection -Port 3389 -ComputerName 203.113.x.x. If it fails, reboot the server. Also confirm NLA is enabled.

Network is slow or intermittent

Remember: your Vietnam server optimises traffic within Vietnam. Any hop leaving Vietnam crosses international transit, latency to your office in Europe or North America depends on the international backhaul and your own domestic internet. This is not a limitation of the server; it is the reality of geography. Run a traceroute (traceroute 203.113.x.x from your end) to see the path and identify bottlenecks.

FAQ

Related articles

• How to connect to a Linux VPS for the first time via SSH
• Hardening SSH on a new VPS: keys, ports, fail2ban, and CrowdSec
• VPS performance benchmarking with fio, sysbench, iperf3
• Docker networking explained: bridge, host, overlay