Production UFW Firewall Baseline for Web & Database Servers

Default-deny firewall baseline using Uncomplicated Firewall (UFW) to isolate internal database ports from public internet scanning.

1. Attack Signature & Impact Analysis

Critical (Direct DB Exposure)

Exposing MySQL (3306), Postgres (5432), or Redis (6379) directly to 0.0.0.0 results in automated ransomware worms encrypting your databases within hours.

2. Production Hardening Configuration (`/etc/ufw/rules.sh`)

Deploy this validated configuration to your production server or reverse proxy:

# 1. Set default policies (Block all incoming, allow outgoing)
ufw default deny incoming
ufw default allow outgoing

# 2. Allow SSH (Keep port 22 or custom port open)
ufw allow 22/tcp comment 'SSH Access'

# 3. Allow standard HTTP & HTTPS
ufw allow 80/tcp comment 'HTTP'
ufw allow 443/tcp comment 'HTTPS'

# 4. Restrict Database access to internal application server IP ONLY
ufw allow from 10.0.0.15 to any port 5432 proto tcp comment 'PostgreSQL from App Server'

# 5. Enable firewall
ufw enable

3. Live Simulation & Rule Verification Command

Execute these commands to verify that traffic is actively mitigated without service downtime:

# Check active firewall rules with numbered list
ufw status numbered
# Confirm database port is NOT accessible from public outside
nmap -p 5432 YOUR_PUBLIC_IP

4. Common Misconfigurations & Troubleshooting Gotchas

⚠️ Production Caution: Always run `ufw allow 22/tcp` BEFORE running `ufw enable`, otherwise you will be immediately disconnected from your VPS cloud instance!

5. Best Paired With (Complementary Defense Recipes)

Security engineers implementing this rule frequently deploy these complementary baselines: