How to make private network on vps?

I want to make a staging development environment. So that it could be reachable only by vpn. Is it possible to do it only with vps? I use contabo vps, and by default, once I open a port on the server it opens for everyone. I tried to use ufw, but it doesn't work with docker, but mostly all my workloads are in docker(rancher Kubernetes). Is there another firewall that will close all ports on the server. How do I connect nodes together so they are reachable by each other but, not the outside world?

I know that I could buy a dedicated server, install hypervisor and pfsense. But is it possible to do a similar thing with only vps without nested virtualization?