The principle
A fresh server should accept connections only on the ports your services use. On Joy, DDoS scrubbing filters attack traffic upstream, but a host firewall is still what stops a forgotten database port from being reachable by the whole internet. Always keep the noVNC console on the server page in mind: it works even if you block SSH or RDP, so a mistake is never fatal.
Ubuntu: UFW
# allow what you need FIRST
ufw allow OpenSSH # or: ufw allow 22/tcp
ufw allow 80,443/tcp # web
# ufw allow 25565/tcp # example: Minecraft
# ufw allow from 203.0.113.0/24 to any port 3306 # MySQL only from your office
ufw default deny incoming
ufw default allow outgoing
ufw enable # answer y — existing SSH sessions are kept
ufw status verboseIf you changed the SSH port, allow the new port before enabling. To remove a rule: ufw delete allow 80,443/tcp. To log dropped packets: ufw logging low and read /var/log/ufw.log.
Rate-limiting SSH
ufw limit OpenSSH blocks an address that opens more than six connections in 30 seconds — a cheap brake on brute force. Pair it with SSH keys and fail2ban (apt install fail2ban; the default jail covers sshd).
Docker caveat
Docker publishes ports by writing iptables rules that bypass UFW. Either bind containers to 127.0.0.1 (-p 127.0.0.1:8080:80) and front them with nginx, or set "iptables": false in /etc/docker/daemon.json and manage rules yourself.
Windows Defender Firewall
The Windows firewall is on by default with sensible profiles. Manage it with PowerShell:
# see what is open
Get-NetFirewallRule -Enabled True -Direction Inbound | Where-Object Action -eq Allow | Select DisplayName, Profile
# open a port
New-NetFirewallRule -DisplayName 'Web 80/443' -Direction Inbound -Protocol TCP -LocalPort 80,443 -Action Allow
# restrict RDP to your office
Set-NetFirewallRule -DisplayGroup 'Remote Desktop' -RemoteAddress 203.0.113.0/24
# make sure the profile on the public adapter blocks by default
Set-NetFirewallProfile -Profile Public,Private,Domain -DefaultInboundAction BlockDisable rules you do not need (file and printer sharing, remote management) unless the server is on a private VLAN. The account-lockout policy in secpol.msc complements the firewall for RDP — see the RDP guide.
What to open — a cheat sheet
| Service | Port | Advice |
|---|---|---|
| SSH | 22/tcp (or custom) | keys only, rate-limit |
| RDP | 3389/tcp (or custom) | NLA on, restrict source IPs |
| HTTP / HTTPS | 80, 443/tcp | open; put the CDN in front if you can |
| MySQL / PostgreSQL | 3306 / 5432 | never public — use an SSH tunnel or a private VLAN |
| Redis / Memcached | 6379 / 11211 | never public — bind to 127.0.0.1 |
| Game servers | varies (often UDP) | open only the game ports; tell us the protocol for tuned scrubbing |
| 25, 465, 587, 993 | 25 outbound is closed by default on Joy; request by ticket |
Private VLANs
Servers in the same Joy region can talk over a private VLAN that is not reachable from the internet. Put databases, caches and internal APIs there and open their ports only on the private interface (ufw allow in on ens19 to any port 3306).
Verify from outside
From your laptop: nmap -Pn YOUR_IP (or an online port checker) should list only the ports you intended. Repeat after every change.