Free Open Ports Scan (Non-Intrusive)

Linux host firewall (ufw)

# Default-deny inbound, allow only what you need
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Public web traffic
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# SSH only from a trusted admin range
sudo ufw allow from 203.0.113.0/24 to any port 22 proto tcp

# Explicitly close a previously exposed database port
sudo ufw deny 3306/tcp
sudo ufw enable

AWS Security Group (Terraform)

resource "aws_security_group" "web" {
  name        = "web-sg"
  description = "Public web only; admin scoped to office IP"
  vpc_id      = var.vpc_id

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["203.0.113.10/32"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

GCP firewall rule (gcloud)

# Allow only HTTPS from anywhere
gcloud compute firewall-rules create allow-https \
  --network=default \
  --direction=INGRESS \
  --action=ALLOW \
  --rules=tcp:443 \
  --source-ranges=0.0.0.0/0

# Restrict SSH to a known admin CIDR
gcloud compute firewall-rules create allow-ssh-admin \
  --network=default \
  --direction=INGRESS \
  --action=ALLOW \
  --rules=tcp:22 \
  --source-ranges=203.0.113.0/24

# Deny direct access to the database tier
gcloud compute firewall-rules create deny-db-public \
  --network=default \
  --direction=INGRESS \
  --action=DENY \
  --rules=tcp:3306,tcp:5432,tcp:6379,tcp:27017 \
  --source-ranges=0.0.0.0/0