Set up a firewall with UFW

UFW ("Uncomplicated Firewall") is the easiest way to control which ports are open.

Allow SSH first

ufw allow OpenSSH

Never enable the firewall before allowing SSH, or you will lose your session.

Allow what you host

ufw allow 80/tcp      # HTTP
ufw allow 443/tcp     # HTTPS
ufw allow 25565/tcp   # example: a Minecraft server

Default policy and enable

ufw default deny incoming
ufw default allow outgoing
ufw enable
ufw status verbose

Remove a rule

ufw status numbered
ufw delete 3

Docker note

Docker publishes container ports by editing iptables directly, which can bypass UFW rules. Bind containers to 127.0.0.1 (-p 127.0.0.1:8080:80) and put a reverse proxy in front if you don't want a port exposed publicly.