Appearance
Firewall (UFW)
Status
UFW is active with the following default policies:
| Direction | Policy |
|---|---|
| Incoming | Deny |
| Outgoing | Allow |
| Routed | Deny |
Allowed Incoming Ports
| Port | Protocol | Purpose |
|---|---|---|
| 22/tcp | SSH | Secure shell (protected by Fail2Ban) |
| 80/tcp | HTTP | Caddy HTTP redirect |
| 443/tcp | HTTPS | Caddy HTTPS |
nftables Integration
UFW manages nftables rules. The active rule set includes:
- Loopback traffic permitted
- Established/related connections permitted
- ICMP types: destination-unreachable, time-exceeded, parameter-problem, echo-request permitted
- DHCP (67→68) permitted
- mDNS (5353) and SSDP (1900) permitted
- Docker integration via
DOCKER-USERchain in FORWARD
iptables Policies
| Chain | Policy |
|---|---|
| INPUT | DROP (managed by UFW) |
| FORWARD | DROP (with Docker exceptions) |
| OUTPUT | ACCEPT |
Implementation Notes
- Only ports 22, 80, and 443 are exposed to the public internet
- All application services (Nextcloud, n8n, Radicale, Portainer, code-server) listen on
127.0.0.1only - Caddy handles TLS termination and reverse proxies to local services
- Docker bypasses UFW for published ports via the FORWARD chain — currently all application ports are bound to 127.0.0.1 only, so this is not a concern