Which Ports Should Be Open on Your Server? A Firewall Check

Which ports should be open: a quick reference

A port is a numbered door on your server that a service listens on. The rule is simple: open a door only if strangers on the internet need it. For a business website, that is the web traffic ports and nothing else.

Cloud firewall vs host firewall: use both

There are two places to block ports. A cloud firewall is set in your provider's dashboard and filters traffic before it reaches the server. A host firewall such as UFW or firewalld runs on the server itself.

DigitalOcean says its Cloud Firewalls are provided at no additional cost and block all traffic that is not expressly permitted. AWS notes in its Lightsail firewall guide that new Linux instances allow SSH on port 22 from all IP addresses by default, and that if two rules cover the same port the more permissive one wins. Check and tighten those defaults.

The Docker and UFW trap

Many small business apps now run in Docker. Docker's own packet filtering documentation warns that Docker and ufw are incompatible: when you publish a container port, traffic is routed before it reaches the chains ufw uses, "effectively ignoring your firewall configuration".

In practice, a line like `ports: "5432:5432"` in a docker-compose file can expose your database to the internet even though UFW says port 5432 is denied. Two fixes:

• Bind internal services to localhost only, for example `127.0.0.1:5432:5432`, or do not publish them at all and let containers talk over a Docker network.
• Rely on the cloud firewall as the outer wall, since Docker cannot bypass a filter that sits outside the server.

Our guide to the CARBONATO Docker botnet covers checking a Docker host for signs of compromise.

How to check which ports are open on your server

Check from both sides: what the server is listening on, and what the internet can actually reach.

1. 1

   List what is listening on the server

   Run `sudo ss -tulpn`. Anything listening on 0.0.0.0 or [::] accepts connections on every network interface. Anything on 127.0.0.1 is local only, which is what you want for databases.

2. 2

   Review the cloud firewall rules

   In your provider's dashboard, list every inbound rule. Remove rules for ports you do not recognise and change "all IPs" to your office IP for SSH and admin panels.

3. 3

   Review the host firewall

   Run `sudo ufw status verbose`. Ubuntu's firewall guide shows how to allow a port only from one address, for example SSH from your office IP.

4. 4

   Scan from outside

   From a different network (home connection or a separate VPS), run `nmap -Pn your-server-ip`, or use an online port scanner. Only scan servers you own or are authorised to test.

5. 5

   Fix and re-scan

   Close anything unexpected, then scan again. Compare the result with your list of services that should be public.

6. 6

   Repeat after every change

   New apps, Docker updates and control panel installs often open ports. Re-check after each deployment and at least monthly.

Safe SSH and admin access without leaving ports open

SSH is the most common port people leave open to the world. Restricting it does not mean losing access.

If your office IP changes often, a small VPN or a zero-trust access tool lets staff reach admin ports without opening them to everyone. CSA's Cyber Essentials mark also expects secure configuration and limited admin access, so these steps count towards it.

What a CIS benchmark adds

The Center for Internet Security publishes free CIS Benchmarks, detailed hardening guides for Ubuntu, Debian, Windows Server, Docker and cloud platforms. They include firewall rules and much more: services to disable, logging, file permissions and account settings.

A full benchmark is long, and not every control suits a small web server. A practical approach is to apply the firewall, SSH and update sections first, then work through the rest as time allows, recording any control you deliberately skip and why.

Do it yourself or get help?

If you are comfortable on the command line, the steps above take under an hour for one server. If the server was set up by a developer who has moved on, runs Docker, or you are not sure what each open port does, get it reviewed before closing things, so you do not break the site.

IT Sorted is a Singapore-based team of developers with over 10 years of experience. Our Software & Server Protection Setup (S$590 for one server) sets up UFW or your cloud firewall with only the ports you need, key-only SSH with root login off, brute-force protection, automatic security updates, daily malware scans and a written runbook, all on tools in your own account. Security testing that tries to break in is not included and needs a CSA-licensed provider.