Allow only needed firewall traffic

A home LAN is not automatically trusted. A compromised laptop, a guest’s phone, a cheap IoT device: anything on your network can reach anything that listens. The host firewall limits which services accept connections and from where.

On Ubuntu that firewall is UFW, and the right posture is deny by default, then allow exactly what you listed.

Know your subnet before writing rules

Check what the local subnet actually is:

ip route
# default via 192.168.1.1 dev enp3s0
# 192.168.1.0/24 dev enp3s0 proto kernel scope link src 192.168.1.50

Here the LAN is 192.168.1.0/24. Substitute the real local subnet after verifying it. A wrong rule can lock you out.

Deny by default, allow SSH first

Order matters. Allow SSH from the local subnet before enabling UFW:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp
sudo ufw enable
sudo ufw status verbose

The status output should show Default: deny (incoming), allow (outgoing) and your SSH rule. Rules added before enable take effect the moment the firewall turns on, which is why SSH goes in first.

Verify both directions

Keep the current SSH session open and test a new one from another device. The old session is your recovery path if the new one fails.

Then compare what listens with what you allowed:

sudo ss -tlnp

Every listener in that output should either have a matching allow rule or be bound to 127.0.0.1, where the firewall isn’t needed. Scan only your own server from an authorized client if you want an outside view; scanning other people’s machines is not a lab exercise.

If you do lock yourself out

It happens: a typo in the subnet, or an allow rule on the wrong port. The symptom is a new SSH connection that hangs and times out while the old one still works.

From the console, sudo ufw status numbered shows the rules, sudo ufw delete <n> removes the bad one, and sudo ufw disable turns the firewall off entirely while you regroup. This is exactly why console access stays available until the rules are proven.