Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
On a newly provisioned VPS, TCP port 22 is usually normal when the image includes OpenSSH for administration. Ports 80 and 443 are normal only when you intentionally installed or selected a public web server or API. Other listeners—including DNS, DHCP, databases and application ports—are normal only when your workload needs them.
A port number alone does not tell you whether a VPS is exposed. Check the service behind it, whether it uses TCP or UDP, the address it is bound to, and whether your provider’s firewall or security group permits traffic. Inventory first, preserve a working administration path, then remove or restrict anything you do not need.
What an “open port” actually means
Ubuntu Security documentation defines an open port as “a network port bound to a service and actively listening for incoming connections or packets.” The important parts are bound to a service and actively listening: a firewall rule by itself does not prove that an application is running, and a running application does not necessarily mean it is reachable from the internet.
Ubuntu has followed a “No Open Ports” policy since Ubuntu 6.06 LTS (Dapper Drake), aiming to keep default installations free of listening network services where possible. Cloud images are a practical exception to that expectation because providers commonly install OpenSSH so that you can log in after the VPS is created. That is why TCP 22 is frequently present on a new server even when you have not installed any application software.
#1 Best Overall
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
The safe interpretation is therefore conditional:
- TCP 22: expected when OpenSSH is installed and you administer the VPS over SSH.
- TCP 80 and 443: expected only for an intentionally public website, reverse proxy or API.
- Any other port: acceptable only when you can identify the required service, its intended users and its exposure boundary.
Ubuntu’s guidance is to limit traffic that can reach open ports with a firewall and to close ports that are not necessary. Apply that principle at both the cloud-provider layer and inside the guest operating system.
Inventory the listeners before changing anything
Do not start by deleting firewall rules or stopping random processes. First create a factual inventory of what is listening, on which protocol and address.
List listening TCP and UDP sockets
ss -utlnThe options mean: -u UDP, -t TCP, -l listening sockets, and -n numeric addresses and ports. Numeric output avoids misleading service-name translations and makes IPv4-versus-IPv6 bindings visible.
Show the process behind each socket
sudo ss -utlnpThe privilege escalation is needed to reveal process and program information for sockets owned by other users. Record the process name, PID and listening address before deciding whether the port is needed. A listener may belong to a system service, a container runtime, a manually started application or a provider-installed agent.
Read the local address correctly
127.0.0.1:PORTis IPv4 loopback. Only programs on the VPS can reach it through that address.[::1]:PORTis IPv6 loopback and is likewise host-local.0.0.0.0:PORTlistens on all IPv4 interfaces, including the public interface unless another control blocks it.[::]:PORTlistens on all IPv6 interfaces. Depending on the operating system’s dual-stack behavior, an IPv6 wildcard listener may also accept IPv4-mapped connections; verify rather than assume.- A specific private or public address limits the listener to that interface, but the provider firewall and guest firewall still determine whether packets can arrive.
When assessing internet exposure, exclude listeners bound only to 127.0.0.1 and [::1]. They can still matter for local privilege escalation or an accidentally exposed proxy, but they are not directly reachable from the public network.
Which ports are commonly normal?
The table below describes common situations, not a universal allowlist. Your image and workload determine what belongs on your VPS.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute| Port | Protocol | When it is normal | What to verify | Typical action when unused |
|---|---|---|---|---|
| 22 | TCP | OpenSSH administration is installed and you use SSH. | Which accounts may log in, whether access is restricted by source address, and whether IPv4 and IPv6 rules match. | Keep it reachable through your administration path, then restrict sources or remove SSH only after another management method is confirmed. |
| 80 | TCP | An intentional public HTTP website, redirector, reverse proxy or API is running. | Which service owns the socket and whether unencrypted HTTP is required or only used to redirect to HTTPS. | Stop or reconfigure the web service and remove the ingress rule if no public HTTP endpoint is needed. |
| 443 | TCP | An intentional public HTTPS website, reverse proxy or API is running. | Certificate termination, virtual hosts, application ownership and whether the service should be public. | Stop the service or bind it privately, then remove public ingress when it is no longer required. |
| 53 | TCP/UDP | The VPS is deliberately operating authoritative DNS, a recursive resolver for an approved network, or another DNS service. | Whether it is bound publicly or only to loopback/private interfaces; recursive DNS must not be accidentally open to the internet. | Disable the DNS service or limit its bind addresses and source networks. |
| 67/68 | UDP | A DHCP server or client function is intentionally present on the network design. | Whether the VPS is actually supposed to provide or consume DHCP; public VPS deployments usually do not need a DHCP server listener. | Stop the unnecessary DHCP service and remove any corresponding rule. |
| 123 | UDP | The machine is deliberately providing NTP service to an approved network. | Whether it is a client making outbound time requests or a server accepting inbound requests. | Keep client operation outbound-only; restrict or disable an unneeded public NTP server. |
| 25 | TCP | The VPS intentionally sends or receives mail directly as an SMTP host. | Mail-service configuration, abuse controls and whether the provider permits inbound or outbound SMTP. | Disable the mail daemon or restrict it to trusted peers when direct mail service is not part of the design. |
| 3306, 5432, 6379 and similar database ports | Usually TCP | A database or cache is deliberately serving an application or approved private clients. | Bind address, authentication, encryption and private-network routing. A public bind is a different risk from loopback or private-subnet access. | Stop the service, bind it to loopback/private addresses, or allow only the application’s source network. |
| Application-specific ports | TCP or UDP | A documented application, game server, agent or control plane requires the port. | Owner, protocol, expected clients and whether the service supports authentication and encryption. | Stop or reconfigure the application and remove both provider and guest ingress rules. |
Seeing a port in this table does not make it safe automatically. A DNS, database or application listener on 0.0.0.0 or [::] may be publicly reachable, while the same process on loopback may be intentionally private. Treat the bind address as part of the finding.
Use two firewall layers with the same least-privilege intent
A provider firewall—often called a security group, cloud firewall or network ACL—can discard packets before they reach the VPS. The guest firewall then enforces policy on the operating system. Use both layers rather than assuming one makes the other unnecessary.
For a basic web server, a least-privilege design might look like this:
| Traffic | Provider layer | Guest layer | Reason |
|---|---|---|---|
| SSH administration | Allow TCP 22 only from your office, VPN or management addresses when feasible. | Allow TCP 22 from the same trusted sources. | Reduces password-guessing and scanning exposure while preserving administration. |
| Public HTTP | Allow TCP 80 from the internet only when the site needs HTTP. | Allow TCP 80 only while the web service is intended to answer there. | Supports a public site or HTTP-to-HTTPS redirect. |
| Public HTTPS | Allow TCP 443 from the internet for a public TLS endpoint. | Allow TCP 443 to the process that terminates TLS. | Provides the normal encrypted web entry point. |
| Database or admin API | Allow only the application subnet or management network. | Repeat the same source restriction locally. | Prevents accidental exposure if a provider rule is later broadened. |
| Everything else | Deny by default unless a documented requirement exists. | Deny by default unless a documented requirement exists. | Limits unexpected services and configuration drift. |
Write down the intended source, destination, protocol and port for every exception. Check both IPv4 and IPv6 policies: allowing only IPv4 while leaving an IPv6 wildcard listener reachable can create an exposure that is invisible in an IPv4-only test.
Close unused ports safely with UFW
UFW (Uncomplicated Firewall) is a front end for Linux firewall rules and is commonly available on Ubuntu. The order matters: preserve SSH access first, then enable or tighten the firewall, then remove unneeded rules.
Rank #2
- WatchGuard Firebox T45 tabletop appliances bring enterprise-level network security to small office/branch office and retail environments. These appliances are small-footprint, cost-effective security powerhouses that deliver all the features present in WatchGuard’s higher-end UTM appliances, including all security capabilities, such as AI-powered anti-malware, threat correlation, and DNS-filtering.
- 5G and Wi-Fi 6 enabled models available. Up to 3.94 Gbps firewall throughput, 5 x 1Gb ports, 30 Branch Office VPNs
- Zero-touch deployment makes it possible to eliminate much of the labor involved in setting up a Firebox to connect to your network - all without having to leave your office. A robust, Cloud-based deployment and configuration tool comes standard with WatchGuard Firebox appliances. Local staff connects the device to power and the Internet, and the appliance connects to the Cloud for all its configuration settings.
- Firebox T45 models make network optimization easy. With integrated SD-WAN and optional 5G technology, you can ensure failover to the cellular network, minimize disruptive connectivity, and establish secure and reliable connections for small offices.
- Standard Support includes 24x7 access to technical support, with an unlimited number of incidents with a targeted response time of 24 hours for low priority, 8 hours for medium priority, 4 hours for high priority, and live calls for critical priority. Support is Web-Based and Phone-Based.
1. Confirm your current administration path
Identify whether your session uses SSH over IPv4, SSH over IPv6, a provider console, a VPN or another management channel. Keep that channel open in a second session while making changes. If you are connected through a nonstandard SSH port, substitute that port in every rule; do not assume 22.
2. Add the SSH exception before enabling UFW
For the conventional SSH port:
sudo ufw allow 22/tcpIf SSH should be reachable only from a known management address, use a source-restricted rule instead:
sudo ufw allow proto tcp from TRUSTED_IP to any port 22TRUSTED_IP represents the public address or network from which you administer the VPS. Use a stable VPN or office range where possible, and confirm that the rule matches the address actually seen by the VPS.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute3. Add only the public services you intentionally run
sudo ufw allow 80/tcp
sudo ufw allow 443/tcpDo not add these rules merely because the ports are familiar. Add them when a web service is installed, listening and meant to be public. If your service is private, allow the required source network instead of the whole internet.
4. Review the active policy
sudo ufw status numbered
sudo ufw status verbosestatus numbered gives rule numbers useful for deletion. The verbose view shows defaults and whether logging is enabled. Confirm that the SSH rule is present before enabling UFW on a newly configured machine.
5. Enable UFW while a fallback session is available
sudo ufw enableKeep your existing SSH connection and a provider console or second SSH session available until you have tested a new connection. A typo in a source restriction, a missing IPv6 rule or an incorrect port can otherwise lock you out.
6. Delete a rule you no longer need
Delete by its exact specification:
sudo ufw delete allow 80/tcp
sudo ufw delete allow 443/tcpOr list numbered rules and delete the unwanted number:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo ufw status numbered
sudo ufw delete NUMBERBecause rule numbers can change after a deletion, re-run sudo ufw status numbered before removing another numbered entry. Deleting a firewall rule does not stop the service; it only removes that path through UFW.
Stop, disable or rebind the service—not just its firewall rule
If a listener is unnecessary, close it at the source as well as at the firewall. A blocked service still consumes resources, may be reachable through a future firewall mistake and can expose a local attack surface.
Stop a systemd service immediately
sudo systemctl stop SERVICEReplace SERVICE with the service name identified during inventory. Re-run sudo ss -utlnp to confirm that its socket disappeared.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Prevent it from starting after reboot
sudo systemctl disable SERVICESome services are socket-activated or restarted by another supervisor. If the port returns, inspect the unit’s status and the process owner rather than repeatedly deleting firewall rules. Remove a package only after confirming that no required application depends on it.
Rank #3
- Integration with Unifi Controller. Powerful firewall performance
- Convenient VLAN support. QoS for enterprise VoIP
- VPN server for secure communications. 10/100/1000Base-T
- 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
- Refer instruction manual for troubleshooting steps.
Keep the service but make it private
For a database, admin panel or internal API that the VPS still needs, change its configuration to bind to 127.0.0.1, [::1] or a private interface. Then restart the service and verify the new address with ss. A private bind is often safer than exposing a management port and trying to secure it with a broad internet-facing rule.
Validate the result from inside and outside the VPS
Check listeners again
sudo ss -utlnpConfirm that a removed service is no longer listening, and that an intentionally private service is bound only to loopback or a private address. Remember to check both TCP and UDP; closing a TCP rule does not close a separate UDP listener.
Check UFW’s effective state
sudo ufw status verboseLook for the expected default policy, the intended SSH exception and only the web or application rules you documented. A rule that says “ALLOW” is not proof that a process is listening, and a process that is listening is not proof that the provider firewall allows it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Test from an appropriate external vantage point
From a network outside the VPS—such as your workstation’s separate internet connection or an approved monitoring host—test only the ports you are authorized to assess. Confirm that SSH remains reachable from the trusted source, that public HTTP or HTTPS behaves as intended, and that restricted services are unreachable from an untrusted source. Test IPv6 separately when the VPS has a public IPv6 address; an IPv4-only check cannot establish IPv6 exposure.
Interpret results carefully. “Closed” can mean no service is listening, while “filtered” can mean a firewall is silently dropping traffic. Both may be acceptable, but the configuration should match your goal: stop an unneeded service, bind a needed service privately, and enforce the intended ingress policy at both firewall layers.
Common failure modes and recovery steps
You enabled UFW and lost SSH
- Use the provider’s out-of-band serial, web or recovery console if available.
- Inspect
sudo ufw status numberedand add an allow rule for the actual SSH port and source. - Reload or disable UFW from the console only long enough to restore a correct rule.
- Open a fresh SSH session before closing the console session.
A second live session is the simplest prevention. Never make the first firewall change in your only connection.
The port remains listed after deleting its UFW rule
The rule and the listener are separate. Use sudo ss -utlnp to identify the process, then stop, disable or rebind that service. Also check whether a container, socket-activated unit or process supervisor recreated it.
The port is not listed locally but appears open externally
Verify that you tested the correct IP address and protocol, including IPv6. Check provider-level forwarding, load balancers, managed proxies and container publishing. A different machine or network component may be answering on the address you scanned.
SSH is exposed even though you changed the port
Changing the SSH port is not a substitute for source restriction, strong authentication and firewall policy. Inventory the actual listening port, permit it before enabling UFW, and remove the old 22 rule only after confirming that no second SSH daemon or provider access path uses it.
A service needs local access but not public access
Prefer loopback or private-interface binding and a narrowly scoped provider and UFW rule. Do not solve a local-only requirement by allowing the service from 0.0.0.0/0 or its IPv6 equivalent.
A repeatable checklist for every new VPS
- Run
ss -utln, thensudo ss -utlnp, and record every listener. - For each listener, identify the service, protocol, bind address, owner and business purpose.
- Classify loopback, private-interface and wildcard bindings separately.
- Confirm the provider firewall or security group allows only required sources and ports.
- Before enabling UFW, allow the current SSH port from the actual administration path.
- Add TCP 80 or 443 only when a public web endpoint is intentional; add other ports only for documented workloads.
- Stop and disable unneeded services, or rebind necessary services to loopback or private addresses.
- Review
sudo ufw status numberedandsudo ufw status verbose. - Re-run
sudo ss -utlnpafter every service change. - Test IPv4 and IPv6 from an external network, keeping a recovery console or second session available.
What “normal” should mean on your VPS
A normal port is not one that appears on a popular list; it is one backed by an identified service and a deliberate exposure decision. On most fresh Ubuntu-based VPS deployments, SSH on TCP 22 is expected because it provides initial administration. HTTP 80 and HTTPS 443 are expected only after you choose to publish a web service. Everything else deserves an explanation tied to your image, application and network design.
Recommended Free Tools
Inventory the socket, inspect its bind address, restrict ingress at the provider and guest layers, and verify the result externally. That process closes unnecessary exposure without confusing a deleted firewall rule with a stopped service—or sacrificing the SSH access you still need.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
