Part 3: Make it a real server

12. Firewall#

What you'll do: block every incoming connection except the ones you choose. Time: 10 minutes.

flowchart LR
  I["Incoming connections"] --> F{"Firewall<br/>(UFW)"}
  F -- "port 22: SSH" --> OK["Allowed"]
  F -- "port 5353: .local names" --> OK
  F -- "everything else" --> NO["Blocked"]

Stop: allow SSH before switching the firewall on

If you switch on the firewall without allowing SSH, you lock yourself out and need the server's keyboard to fix it. Follow the steps in order, and keep a second SSH window open as a safety net.

Step 1: Install#

Type on: the server

sudo apt install ufw

Step 2: Allow what you need (before enabling)#

Type on: the server

sudo ufw allow 22/tcp
sudo ufw allow 5353/udp
sudo ufw default deny incoming
sudo ufw default allow outgoing

22/tcp = SSH.
5353/udp = makes homeserver.local work.

Step 3: Check the list#

Type on: the server

sudo ufw show added

You must see ufw allow 22/tcp in the list. If it's missing, repeat step 2.

Step 4: Switch on#

Type on: the server

sudo ufw enable

It warns "may disrupt existing ssh connections". Type y.

Step 5: Test in a NEW window#

Type on: your Mac or PC

ssh homeserver

It must still work.

Type on: the server

sudo ufw status verbose

You should see Status: active, Default: deny (incoming), and your two rules.

Locked out?

Use your still-open safety window, or the server's own keyboard, and run sudo ufw disable. Then redo the steps.

Rules to remember

Never set up "port forwarding" on your router to the server. Chapter 14 gives you safe access from outside.
If you install Docker later: Docker bypasses this firewall. Look up "Docker UFW" before publishing ports.

Done when: ufw status says active and ssh homeserver still works.

Next: 13. Keep a laptop running with the lid closed (laptops only) or 14. Tailscale