Which Open Ports Are Normal on a New VPS—and How to Close Them Safely

On a newly provisioned VPS, TCP port 22 is usually normal because cloud images commonly install OpenSSH for administration. Ports 80 and 443 are normal only when you intentionally run a public website or API. Any other listener should be tied to a service you recognize, bound to the right address, and allowed through both your provider firewall and the VPS firewall only when required. Inventory the listeners before changing rules, preserve your current SSH path, then verify from outside the server.

Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.

What an “open port” actually means

Ubuntu defines an open port as “a network port bound to a service and actively listening for incoming connections or packets.” The number by itself is not enough to judge risk. You also need to know:

#	Preview	Product	Price
1		FortiGate-60F Network Security Appliance Plus 1 Year FortiGuard Unified Threat Protection (UTP) and...	$1,008.87	Buy on Amazon
2		WatchGuard Firebox T45-PoE Network Security/Firewall Appliance (WGT47000-US+WGT470063)	$890.02	Buy on Amazon
3		Ubiquiti Unifi Security Appliance (USG), Single,White	$184.24	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

• Protocol: TCP and UDP are separate. A TCP listener on 53 does not mean the same thing as a UDP listener on 53.
• Process: the program that owns the socket tells you why it is listening.
• Bind address: a service listening only on 127.0.0.1 or [::1] is reachable from the VPS itself, not directly from the internet. A listener on 0.0.0.0 (all IPv4 interfaces) or [::] (all IPv6 interfaces) can be publicly reachable if upstream and host firewalls permit it.
• Network controls: a provider security group or cloud firewall can block traffic before it reaches the guest, while a guest firewall such as UFW can block it locally. Both layers matter.

Ubuntu has followed a “No Open Ports” policy since Ubuntu 6.06 LTS (Dapper Drake): a default installation should not expose listening network services where possible. Cloud images are a practical exception because providers generally need an administration path; OpenSSH is therefore commonly preinstalled.

Which ports are normally open after provisioning?

There is no universal list of “safe” ports. Port 22 is normal for administration, not automatically safe; port 443 is expected for a web server, not automatically required. Treat every listener as a service decision.

#1 Best Overall

FortiGate-60F Network Security Appliance Plus 1 Year FortiGuard Unified Threat Protection (UTP) and FortiCare Premium (FG-60F-BDL-950-12)

• HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
• UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
• OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
• RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
• EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.

$1,008.87

Buy on Amazon

Inventory listeners before changing anything

Start with the socket table. This does not change configuration and is safe to run over your existing SSH session.

1. Run ss -utln to list listening TCP and UDP sockets. The flags request TCP (t), UDP (u), listening sockets (l), and numeric addresses and ports (n).
2. Run sudo ss -utlnp when you need the owning process. The privilege is important because process information for other users may otherwise be hidden.
3. Record each local address, protocol, port, and process before making firewall or service changes. Keep a copy in your change notes so you can reverse an accidental rule.

When assessing internet exposure, separate loopback from wildcard binds. Entries such as 127.0.0.1:5432 and [::1]:5432 are local-only listeners. Entries such as 0.0.0.0:5432 or [::]:5432 listen on every interface in that address family and may be reachable externally. A service can also bind to one specific private or public address, so read the complete local-address column rather than only the port number.

How to read a typical result

• LISTEN 0 4096 0.0.0.0:22 indicates a TCP service accepting IPv4 connections on all interfaces. With -p, the process should identify OpenSSH.
• LISTEN 0 4096 127.0.0.1:8080 is reachable only from the VPS itself. It may be an application backend intended to sit behind a reverse proxy.
• UNCONN 0 0 [::]:53 represents a UDP listener on all IPv6 interfaces. UDP has no TCP-style connection state, so do not dismiss it because it does not say LISTEN.

Seeing a socket in ss proves that a process is listening. It does not prove that the internet can reach it; provider and guest firewall rules, routing, and the address family still determine reachability.

Why port 22 is usually present—and when it is not acceptable

OpenSSH is commonly included in cloud images so the provider can give you administrative access immediately after provisioning. That makes 22/TCP a normal starting point for a new VPS. It is not a requirement to leave it open to every source forever.

Confirm the service

Use sudo ss -utlnp and verify that the process behind 22/TCP is the SSH server you expect. If no administration service should be running, remove or stop it using the operating system and image documentation rather than merely assuming the port number is harmless.

Reduce the source range

A provider firewall and UFW can both restrict SSH to an office, VPN, or other trusted network. The UFW pattern is:

sudo ufw allow proto tcp from TRUSTED_IP to any port 22

Replace TRUSTED_IP with the actual address or network notation accepted by your UFW version. A narrowly scoped rule is preferable to an internet-wide allow when your administration source is stable. If you use multiple networks, add each deliberately and remove broad rules after testing.

Do not change the only session blindly

Before editing SSH policy or enabling a firewall, keep the current session open and arrange a second login path or the provider’s out-of-band console. Test a new SSH connection while the original session remains available. Closing the original session first can turn a recoverable rule mistake into a lockout.

When ports 80 and 443 are normal

HTTP 80/TCP and HTTPS 443/TCP are expected only when you intentionally installed or selected a web service, reverse proxy, or API. A fresh minimal image should not be assumed to expose either port merely because the numbers are familiar.

Use the process-aware socket listing to identify the web server or proxy. Then determine whether it is bound to loopback, a private interface, or all interfaces. A public website normally needs a public bind and corresponding firewall allowances; an internal application may need neither 80 nor 443 on the public address.

Rank #2

WatchGuard Firebox T45-PoE Network Security/Firewall Appliance (WGT47000-US+WGT470063)

• WatchGuard Firebox T45 tabletop appliances bring enterprise-level network security to small office/branch office and retail environments. These appliances are small-footprint, cost-effective security powerhouses that deliver all the features present in WatchGuard’s higher-end UTM appliances, including all security capabilities, such as AI-powered anti-malware, threat correlation, and DNS-filtering.
• 5G and Wi-Fi 6 enabled models available. Up to 3.94 Gbps firewall throughput, 5 x 1Gb ports, 30 Branch Office VPNs
• Zero-touch deployment makes it possible to eliminate much of the labor involved in setting up a Firebox to connect to your network - all without having to leave your office. A robust, Cloud-based deployment and configuration tool comes standard with WatchGuard Firebox appliances. Local staff connects the device to power and the Internet, and the appliance connects to the Cloud for all its configuration settings.
• Firebox T45 models make network optimization easy. With integrated SD-WAN and optional 5G technology, you can ensure failover to the cellular network, minimize disruptive connectivity, and establish secure and reliable connections for small offices.
• Standard Support includes 24x7 access to technical support, with an unlimited number of incidents with a targeted response time of 24 hours for low priority, 8 hours for medium priority, 4 hours for high priority, and live calls for critical priority. Support is Web-Based and Phone-Based.

$890.02

Buy on Amazon

If you no longer publish a service, stop it with the service’s documented administration method and confirm that its socket disappears from ss. Deleting a firewall rule while leaving an unnecessary daemon running does not remove the listening service; conversely, stopping a daemon without reviewing provider rules leaves a stale allowance that could matter if another process later binds the same port.

How provider firewalls and guest firewalls fit together

Use least privilege at two layers. A provider security group or cloud firewall controls ingress before packets reach the virtual machine. The guest firewall enforces policy inside the operating system. Configure both to express the same intent:

• Allow SSH only from the administration networks you need.
• Allow 80/TCP and 443/TCP only when the VPS serves public HTTP or HTTPS.
• Allow DNS, database, or application ports only for the clients that require them, preferably over private networking.
• Cover IPv4 and IPv6 separately. An IPv4 rule does not automatically protect an IPv6 listener.

Cloud firewall examples commonly use selective rules such as tcp:22, tcp:80, and tcp:443. The important property is selectivity: the rule should name the protocol, port, direction, and permitted source rather than opening a broad range by habit. A permissive provider rule cannot be “fixed” by assuming UFW will always be enabled, and a restrictive provider rule can make a correctly configured guest service appear broken.

Close ports safely with UFW

UFW is a host-level policy tool on Ubuntu. The safe sequence is to establish the access you must retain, enable or update the firewall, and then remove unneeded allowances.

1. Check the current policy

Run:

sudo ufw status verbose

If UFW is inactive, do not infer that every listener is reachable; inspect the provider firewall as well. If it is active, read the numbered rules and note whether they cover TCP, UDP, IPv4, and IPv6 as intended.

2. Add the administration rule first

For a broadly reachable SSH endpoint, the basic rule is:

sudo ufw allow 22/tcp

For source restriction, use:

sudo ufw allow proto tcp from TRUSTED_IP to any port 22

Choose one deliberate policy. Do not add a broad 22/TCP rule as a temporary step and forget to remove it after creating a restricted rule.

3. Add only the public services you operate

For an intentional public website or API, add:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Do not add these rules simply because the VPS is new. The service and its bind address should already justify each allowance.

4. Enable UFW only after the path is safe

When your SSH allow rule is present and you have a fallback console or second session, enable the firewall using the command appropriate to your Ubuntu image. Watch the confirmation output and keep the existing session open. If the provider has a separate emergency console, verify that it works before making a restrictive change.

5. Review numbered rules

Run:

sudo ufw status numbered

Numbered output makes it easier to remove the exact entry you intend, especially when duplicate or overlapping rules exist.

Rank #3

Ubiquiti Unifi Security Appliance (USG), Single,White

• Integration with Unifi Controller. Powerful firewall performance
• Convenient VLAN support. QoS for enterprise VoIP
• VPN server for secure communications. 10/100/1000Base-T
• 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
• Refer instruction manual for troubleshooting steps.

$184.24

Buy on Amazon

6. Delete an allowance you no longer need

You can delete by repeating the rule:

sudo ufw delete allow PORT/PROTO

For example, removing an HTTP allowance uses sudo ufw delete allow 80/tcp. You can also delete by rule number:

sudo ufw delete NUMBER

Use the number shown by the immediately preceding status numbered output; numbering can change after a deletion. If a rule was source-restricted, repeat its complete form when deleting so UFW matches the intended entry.

Closing a port is more than deleting a firewall rule

A firewall denial and a stopped service are different outcomes. If the service is obsolete, use its documented stop and disable procedure, then rerun sudo ss -utlnp. If the service is still needed locally, bind it to 127.0.0.1, [::1], or an appropriate private interface when the software supports that configuration. This removes unnecessary public exposure while preserving local functionality.

Do not claim success solely because UFW lists a deny or because a provider rule was removed. A daemon may still be listening, and another firewall layer may still permit or block traffic. The final state should answer three separate questions: is a process listening, on which addresses, and can an authorized external client reach it?

Validate every change from inside and outside

1. Re-run the inventory: use ss -utln and, when needed, sudo ss -utlnp. Confirm that an intentionally removed service is gone or now loopback-only.
2. Inspect UFW: run sudo ufw status verbose and compare the result with your intended SSH, web, and application policy.
3. Review the provider layer: check security groups or cloud firewall rules for both IPv4 and IPv6. Remove stale allowances and verify source restrictions.
4. Test from an appropriate external vantage point: use a machine outside the VPS’s network to test only the ports you are authorized to assess. Test the address family your users will use; an IPv4 success does not establish IPv6 behavior.
5. Retest administration: open a new SSH connection while the original remains active. Only close the original after the new path works.

An external failure can have several causes: the process may be stopped, the service may bind only to loopback, UFW may deny the packet, the provider firewall may deny it, or routing may be absent. Work from the inside out—socket, bind address, guest policy, provider policy, then external test—instead of opening every layer indiscriminately.

Common scenarios and the right decision

A new VPS shows only 22/TCP

This is a normal administration-oriented baseline when OpenSSH is installed. Confirm the process, restrict SSH sources where feasible, and leave other ports closed until you deploy a workload.

A new VPS shows 22, 80, and 443

Verify that a web server, reverse proxy, or image-selected web stack was intentionally installed. If you did not choose that workload, identify the owning processes before allowing public traffic. Remove unused allowances at both firewall layers and stop unneeded services.

A database port appears on 0.0.0.0 or [::]

Treat this as a priority review. A database needed only by local applications should normally use a loopback or private bind. If remote clients are required, restrict provider and guest rules to those clients instead of exposing the port broadly.

A port appears only on 127.0.0.1 or [::1]

It is not directly internet-reachable through that socket. Keep it if a local component needs it, but still identify the process and ensure the application does not also open a wildcard listener on another address.

UFW says a port is allowed, but outside access fails

The service may not be listening, may be bound to loopback, or may be blocked by the provider firewall or routing. Compare ss output, UFW status, and provider rules before changing anything.

Outside access works after you thought you closed the port

Check both address families and all listeners. You may have removed a TCP rule while UDP remains, removed IPv4 coverage while IPv6 remains, or deleted a firewall allowance while the service continues listening through another provider rule.

A repeatable least-privilege checklist

• List TCP and UDP listeners with ss -utln.
• Map each listener to a process with sudo ss -utlnp.
• Classify each bind as loopback, private, specific public address, or wildcard.
• Keep 22/TCP only for an administration path you actually use; restrict its source when practical.
• Keep 80/TCP and 443/TCP only for an intentional public HTTP or HTTPS service.
• Investigate DNS, database, DHCP, and application-specific listeners against the image and workload rather than assuming they are standard.
• Align provider security-group rules and UFW rules, including IPv4 and IPv6.
• Before enabling or tightening UFW, preserve a tested SSH path and an out-of-band recovery option.
• Remove obsolete rules with sudo ufw delete allow PORT/PROTO or the exact numbered rule.
• After every change, verify the process, bind address, firewall state, and an authorized external connection.

Bottom line

Port 22 is commonly normal on a new VPS because OpenSSH provides the initial administration channel. Ports 80 and 443 are normal only for a deliberately deployed public web service. Everything else is workload-dependent. Identify the process and bind address, enforce least privilege in both the provider firewall and UFW, preserve SSH access while changing rules, and verify the result from an external vantage point before declaring a port closed.

Quick Recap

Bestseller No. 1

FortiGate-60F Network Security Appliance Plus 1 Year FortiGuard Unified Threat Protection (UTP) and FortiCare Premium (FG-60F-BDL-950-12)

$1,008.87

Bestseller No. 2

WatchGuard Firebox T45-PoE Network Security/Firewall Appliance (WGT47000-US+WGT470063)

$890.02

Bestseller No. 3

Ubiquiti Unifi Security Appliance (USG), Single,White

Integration with Unifi Controller. Powerful firewall performance; Convenient VLAN support. QoS for enterprise VoIP

$184.24

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

cloud firewallopen portsserver hardeningSSHUbuntuUFWVPS security