Firewall baseline before anyone scans you

Firewall baseline before anyone scans you
Every box gets port-scanned within minutes of boot. Lock it in this exact order so you don't drop your own SSH:
— ufw default deny incoming and ufw default allow outgoing
— ufw allow OpenSSH FIRST (or your custom port)
— ufw allow 'Nginx Full'
— ufw limit ssh — rate-limits brute force on top of fail2ban
— ufw enable and confirm with ufw status numbered
The SSH rule before enable is the whole trick. Try it tonight.