Turn on a firewall on every host

How to do it

Use the system's firewall, such as nftables, ufw or firewalld. Also set the provider's network firewall, so two layers must fail before a port is open. Allow 80 and 443 for the public site and SSH from fixed addresses or the VPN range. Container engines can open ports past ufw, so bind container ports to 127.0.0.1 unless they must be public.

Example

ufw default deny incoming
ufw default allow outgoing
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow from 198.51.100.0/24 to any port 22 proto tcp
ufw enable

# nftables: /etc/nftables.conf
table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    ct state established,related accept
    iif lo accept
    tcp dport { 80, 443 } accept
    ip saddr 198.51.100.0/24 tcp dport 22 accept
    icmp type echo-request accept
    icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-advert } accept
  }
}

How to check

ufw status verbose or nft list ruleset shows the incoming default as deny. A port scan from outside finds only the allowed ports.