Firewall basics: UFW on Ubuntu and Windows Defender Firewall

The principle

A fresh server should accept connections only on the ports your services use. On Joy, DDoS scrubbing filters attack traffic upstream, but a host firewall is still what stops a forgotten database port from being reachable by the whole internet. Always keep the noVNC console on the server page in mind: it works even if you block SSH or RDP, so a mistake is never fatal.

Ubuntu: UFW

# allow what you need FIRST
ufw allow OpenSSH              # or: ufw allow 22/tcp
ufw allow 80,443/tcp           # web
# ufw allow 25565/tcp          # example: Minecraft
# ufw allow from 203.0.113.0/24 to any port 3306  # MySQL only from your office

ufw default deny incoming
ufw default allow outgoing
ufw enable                     # answer y — existing SSH sessions are kept
ufw status verbose

If you changed the SSH port, allow the new port before enabling. To remove a rule: ufw delete allow 80,443/tcp. To log dropped packets: ufw logging low and read /var/log/ufw.log.

Rate-limiting SSH

ufw limit OpenSSH blocks an address that opens more than six connections in 30 seconds — a cheap brake on brute force. Pair it with SSH keys and fail2ban (apt install fail2ban; the default jail covers sshd).

Docker caveat

Docker publishes ports by writing iptables rules that bypass UFW. Either bind containers to 127.0.0.1 (-p 127.0.0.1:8080:80) and front them with nginx, or set "iptables": false in /etc/docker/daemon.json and manage rules yourself.

Windows Defender Firewall

The Windows firewall is on by default with sensible profiles. Manage it with PowerShell:

# see what is open
Get-NetFirewallRule -Enabled True -Direction Inbound | Where-Object Action -eq Allow | Select DisplayName, Profile

# open a port
New-NetFirewallRule -DisplayName 'Web 80/443' -Direction Inbound -Protocol TCP -LocalPort 80,443 -Action Allow

# restrict RDP to your office
Set-NetFirewallRule -DisplayGroup 'Remote Desktop' -RemoteAddress 203.0.113.0/24

# make sure the profile on the public adapter blocks by default
Set-NetFirewallProfile -Profile Public,Private,Domain -DefaultInboundAction Block

Disable rules you do not need (file and printer sharing, remote management) unless the server is on a private VLAN. The account-lockout policy in secpol.msc complements the firewall for RDP — see the RDP guide.

What to open — a cheat sheet

Private VLANs

Servers in the same Joy region can talk over a private VLAN that is not reachable from the internet. Put databases, caches and internal APIs there and open their ports only on the private interface (ufw allow in on ens19 to any port 3306).

Verify from outside

From your laptop: nmap -Pn YOUR_IP (or an online port checker) should list only the ports you intended. Repeat after every change.