Security
Linux firewall setup: open only what the server needs
A host firewall reduces the network services reachable from untrusted networks. The safest starting point is an inventory of required inbound traffic rather than a copied rule set that may block administration or expose services your server does not use.
List the services that should be public
A conventional web server may need HTTP and HTTPS. Administrative SSH may be restricted to known networks or another management path. Databases, caches, metrics, and internal dashboards usually do not need broad public exposure.
Understand both host and provider firewalls
Cloud or hosting providers may offer a network firewall in addition to the guest operating-system firewall. Document both layers so troubleshooting a blocked port does not become guesswork.
Do not forget IPv6
If the server has public IPv6, a policy applied only to IPv4 can leave an unintended path open. Either configure equivalent controls or deliberately disable/address IPv6 according to the architecture.
Protect your management session while changing rules
Add and verify required management access before applying a default-deny policy. Keep console or rescue access available and test from a second session so a mistake is recoverable.