rds

[vedantghode32]

I'm deploying a Java Spring Boot application on Ubuntu. The application runs on port 8080, SSH uses port 22, and users access the application through HTTPS.

Should I open all three ports to the internet, or is there a more secure way to design the network access?

[avirajsalunkhe]

I'd expose only the services that genuinely need public access.

For a typical production deployment, I'd use this design:

• Port 443: Public HTTPS traffic reaches the web server or reverse proxy.
• Port 22: SSH is restricted to a trusted IP address range or VPN.
• Port 8080: The Spring Boot application remains accessible only from the reverse proxy or trusted internal network.

For example, I could configure UFW to allow HTTPS and restricted SSH access:

sudo ufw allow 443/tcp
sudo ufw allow from <TRUSTED_IP> to any port 22 proto tcp
sudo ufw enable
sudo ufw status verbose

I'd ensure that the application binds to an appropriate private interface or localhost when the reverse proxy runs on the same server, and verify that cloud-level firewall rules follow the same principle.

Before enabling UFW on a remote server, I'd confirm that the SSH allow rule matches my actual connection source and that I have a recovery path.

This reduces the public attack surface while allowing users to access the application normally.