UFW on a NAT VPS: Allow the Guest Port, Not the Public Mapping

For an ordinary destination-NAT mapping, the guest firewall filters traffic addressed to the private destination port. If public port 24022 forwards to guest port 22, UFW inside the guest normally needs to permit 22, not 24022.

Inspect before enabling

Confirm the actual SSH listener using ss -lnt and inspect existing firewall rules. If the guest SSH service uses a custom private port, allow that real port instead of copying port 22 from this example. Keep a working SSH session open and know your recovery path.

On a Debian or Ubuntu guest where UFW is installed, a basic example is:

sudo ufw allow 22/tcp
sudo ufw status verbose
sudo ufw enable

Do not run this blindly against an unfamiliar firewall. Enabling a firewall is a configuration change and can interrupt access. Test a new SSH connection immediately afterward before closing the original session.

Add only necessary services

For an application on private TCP port 8080, permit that destination if you intend it to be publicly reachable through a mapping. UDP requires a separate rule. Limit source addresses for private administrative services when practical.

Watch interactions

Docker can manage its own packet-filtering rules, and published container ports may not behave as expected from a simple UFW rule list. Check Docker's firewall documentation and test externally. Also review IPv6 rules if IPv6 is enabled.

See TCP forwarding, Docker networking and mapping diagnosis.

References: Ubuntu firewall guide and Docker firewall documentation.