Network exposure
Configure a default-deny firewall
Allow only required inbound services and stage firewall changes so SSH recovery remains possible.
8 minute lesson
The firewall should express the server’s exposure map. Deny unsolicited inbound traffic, then allow the small set of public services.
On Ubuntu, UFW provides a clear interface over the host firewall. Allow the tested SSH port before enabling it, then add HTTP and HTTPS as needed. A firewall limits reachability but does not patch or authenticate the service behind it.
sudo ufw status verboseA default deny policy turns a forgotten new listener into a local problem instead of a public service. The tradeoff is operational: one missing SSH rule can cut off administration.
Treat the firewall as a second boundary, not as permission to bind every service publicly. Keep databases on private interfaces and verify the rules from outside the host, where an attacker would meet them.
Record the expected public ports, enable matching rules, and scan from another machine. Prove an allowed web port responds, a closed test port fails, and the tested SSH session survives a firewall reload.
Lesson completed