Nginx is running, but UFW still blocks everything except SSH. Nobody outside can reach it. Let’s open exactly the two ports a web server needs and nothing else.

Look at the profiles first

When you installed Nginx, it registered its own UFW application profiles. List them and inspect the one we’ll use:

sudo ufw app list
sudo ufw app info "Nginx Full"

You’ll see three profiles: Nginx HTTP, Nginx HTTPS and Nginx Full. The last one covers 80,443/tcp. Port 80 is plain HTTP, and Certbot also needs it to prove you own the domain. Port 443 is HTTPS.

Add the rule

Allow the combined profile and look at the full rule list:

sudo ufw allow "Nginx Full"
sudo ufw status numbered

The list should now show two rules, OpenSSH and Nginx Full, each repeated once for IPv6 with a (v6) suffix. That means SSH, HTTP and HTTPS. That’s the whole public surface of this server, and it stays that way for the rest of the course. The application we deploy later listens on 127.0.0.1 only, and we never open its port.

Test from your own computer

Local tests on the Droplet can’t tell you if the outside world gets through. Run this from your laptop:

curl -I http://203.0.113.10

HTTP/1.1 200 OK here proves four things at once: Nginx is up, UFW lets the traffic in, the Cloud Firewall lets it in, and the route from the internet to your Droplet works. Yesterday’s curl against 127.0.0.1 could only prove the first.

Reading the failure

The error tells you where to look.

A timeout while curl http://127.0.0.1 works on the server means a firewall dropped the packets. Compare sudo ufw status, the DigitalOcean Cloud Firewall attached to the Droplet, and the IP you typed. The Cloud Firewall sits in front of UFW, so it can block traffic UFW never sees.

Connection refused means the packets arrived but nothing was listening. Check sudo ss -lntp and systemctl is-active nginx.

Rolling back a rule

Added the wrong thing? Find its number with sudo ufw status numbered and delete it with sudo ufw delete <number>. Never delete the SSH rule until you’ve tested another way in.

Confirm the three intended rules in UFW and get a 200 OK from outside the server. HTTPS won’t work yet: curl -I https://203.0.113.10 fails because there’s no certificate. We need a domain first, and that’s the next lesson.

Open HTTP and HTTPS