🎯 Mission Briefing: The Firewall Said No

Last night Vesna turned on the firewall on this web server to stop the password-guessing bots. Since then the shop is unreachable for customers, and she can't log in over SSH from the office. Your own SSH session was already open — connections that existed before the firewall came on keep working.

Read the ticket first: cat ~/ticket-6120.txt

Your objective

Fix the rules so that the right people get in — without switching the firewall off:

• SSH: only from the office network, 198.51.100.0/24
• the shop (HTTP and HTTPS): for everyone
• port 8080 was only for testing: closed

Investigation toolkit

sudo ufw status verbose                  # what's on, what are the defaults?
sudo tail /var/log/ufw.log               # who is being blocked?
sudo grep 'DPT=22 ' /var/log/ufw.log     # who knocked on SSH?
sudo ufw app list                        # ready-made profiles

In the log, SRC= is who knocked and DPT= the port they wanted.

Fix and verify

sudo ufw allow from 198.51.100.0/24 to any port 22 proto tcp
sudo ufw allow 'Nginx Full'
sudo ufw delete allow 8080/tcp
sudo ufw status

💡 ufw disable would "fix" every complaint in a second — and leave the server open to the same bots. A firewall is fixed by its rules.