Firewall
A firewall decides which ports may accept connections from outside and rejects everything else.
Think of it like this
A building's doorman: registered visitors (open ports) get in; strangers stay outside.
In this setup
The server uses Ubuntu's built-in UFW firewall and only allows the ports this setup needs (see "Ports"). If you install another service, remember to allow its port too.
Common misconceptions
- "A firewall makes me completely safe": it only guards the door; the services behind open ports must be secure too (for example, key-only login).
Related: Ports, SSH, public and private keys