A firewall filters network traffic so a virtual machine exposes only the ports it needs. In a manual deployment, it closes the application ports while leaving NGINX and SSH reachable. section 3.6.2 section 3.7
Configure UFW in this order:
- Install Uncomplicated Firewall (UFW) with apt. section 3.6.2
- Allow SSH on port 22 so remote administration and Git pushes continue to work. section 3.6.2
- Allow Nginx Full, which permits HTTP on port 80 and HTTPS on port 443. section 3.6.2
- Review the added rules, then enable the firewall and confirm the activation prompt. section 3.6.2
Protecting the deployed applications
After NGINX routes the root URL to the Python application and /js to the Node.js application, UFW blocks direct access to their ports while preserving web access through NGINX. Forgetting the SSH rule can terminate the current session and remove remote access. section 3.6.1 section 3.6.2
sudo ufw allow ssh sudo ufw allow 'Nginx Full'
Use the UFW rules to allow SSH and NGINX traffic before enabling the firewall. section 3.6.2
