adminCloud Firewall and Security Group Checklist
Cloud firewall rules and security groups decide what traffic can reach your VPS from the internet. They are different from application passwords and different from Nginx routing. This checklist helps you design safe network exposure.
Core principle
Only expose what must be public. Everything else should be private, local or protected behind a reverse proxy, VPN or access control.
Checklist
- List services running on the server.
- Mark which services need public access.
- Allow SSH only as needed.
- Allow HTTP and HTTPS for websites.
- Do not expose database ports publicly.
- Do not expose internal Docker app ports unless required.
- Use Nginx reverse proxy for dashboards when possible.
- Review provider firewall and UFW together.
- Document every open port.
- Review rules after every new service deployment.
Reusable lesson
Security starts with reducing exposed surface. If attackers cannot reach a service, they have fewer ways to abuse it.
When to Use This Checklist
Use this checklist when configuring provider firewall, UFW, security groups or network exposure for a VPS.
Required Tools
Cloud provider firewall, UFW, SSH access, service list, Nginx, Docker port list, recovery console
Before You Start
Make sure you have console recovery access before tightening SSH or firewall rules.
Structured Checklist Steps
- List services.
- Identify public services.
- Allow SSH intentionally.
- Allow HTTP.
- Allow HTTPS.
- Block database ports.
- Block internal app ports.
- Use reverse proxy.
- Review UFW and provider firewall.
- Document open ports.
Verification Steps
- Only required ports are open.
- Website still loads.
- SSH still works.
- Database is not public.
- Docker internal ports are protected.
Rollback Plan
If firewall changes block access, use provider console to restore previous rules or temporarily disable the restrictive rule.
Common Mistakes
- Opening all ports.
- Exposing MySQL publicly.
- Forgetting provider firewall and UFW can both apply.
- Exposing Docker dashboards directly.
- No documentation of open ports.
Related Commands
sudo ufw status numbered
sudo ss -tulpn
sudo ufw allow 80
sudo ufw allow 443
sudo ufw deny 3306
docker ps