Protect your data firstKeep a current off-server backup before reinstalling, updating, changing firewall rules, or running an application installer.
On this page
Common starting points
| Purpose | Common default | Important check |
|---|---|---|
| SSH | TCP 22 | Your service may use another port |
| Websites | TCP 80 and 443 | Check domain and HTTPS setup |
| Windows RDP | TCP 3389 | Restrict sources or use a VPN |
| WireGuard | UDP 51820 | Use the actual configured endpoint |
Defaults are not proof of your server configuration. Use the service details and application documentation.
Separate public and private services
Database ports, container APIs, and administrative dashboards normally should not be public. Allow a specific trusted source when remote administration is necessary. Test recovery access before applying firewall changes.
Docker warning
Published Docker ports can bypass normal UFW filtering. Do not assume a host-firewall setting alone protects a published container. Review the actual exposure from a trusted second device.