Firewall configuration

Configure only the required network paths. Existing active policies and rules must be understood before changing defaults; an allowed SSH rule does not demonstrate that a fresh connection works.

Inventory

• Inspect ss -ltnup, effective SSH ports, ssh.socket where present, ufw status verbose, ufw show added, provider security groups and any container-published ports.
• Identify actual management ports and approved source IPv4/IPv6 ranges. With socket activation or a custom daemon invocation, confirm the listener rather than relying on sshd_config alone.
• Check /etc/default/ufw IPv6 handling. Include relevant external IPv6 tests; IPv4 filtering cannot establish IPv6 isolation.
• Record a console recovery path and the current rules/policies. Do not reset UFW as routine troubleshooting.

Read references/ufw-rules.md for source-restricted rules, routing, Docker and recovery.

Configure

Install UFW/iproute2 first if the authorized setup requires them. Preview scripts/setup-firewall.sh: