Configure a default-deny firewall

The firewall should express the server’s exposure map. Deny unsolicited inbound traffic, then allow the small set of public services.

On Ubuntu, UFW provides a clear interface over the host firewall. The safe sequence is: set the default policy, allow SSH, then enable.

Set policy and allow SSH first

Allow the tested SSH port before enabling the firewall. In the other order, ufw enable drops your own connection path:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable

OpenSSH is an application profile that maps to 22/tcp. If your sshd listens on another port, allow that port explicitly instead.

Then add HTTP and HTTPS as needed:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Verify the ruleset

sudo ufw status verbose

Status: active
Default: deny (incoming), allow (outgoing), disabled (routed)

To                         Action      From
--                         ------      ----
22/tcp (OpenSSH)           ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere

The deny (incoming) default is the line that matters. A default deny policy turns a forgotten new listener into a local problem instead of a public service. The tradeoff is operational: one missing SSH rule can cut off administration.

Confirm from another machine that an allowed port answers and everything else does not:

nc -vz 203.0.113.10 443   # succeeds
nc -vz 203.0.113.10 5432  # times out

A firewall limits reachability but does not patch or authenticate the service behind it. Treat the firewall as a second boundary, not as permission to bind every service publicly. Keep databases on private interfaces and verify the rules from outside the host, where an attacker would meet them.

Record the expected public ports, enable matching rules, and scan from another machine. Prove an allowed web port responds, a closed test port fails, and the tested SSH session survives a firewall reload.