Which Open Ports Are Normal on a New VPS—and How to Close Them Safely

On a newly provisioned VPS, TCP 22 is usually normal when the image includes OpenSSH. Ports 80 and 443 are normal only when you intentionally installed a public website or API. Other listeners—including DNS, DHCP, database, and game-application ports—depend on the image and workload. A port number by itself does not tell you whether exposure is appropriate: identify the listening service, protocol, bind address, and the provider firewall rule that permits ingress.

Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.

Inventory the machine before changing anything, keep an SSH allow rule for your current administration path, then enforce the smallest required set at both the cloud firewall and the guest firewall. Validate from outside the VPS after every change.

#	Preview	Product	Price
1		FortiGate-60F Network Security Appliance Plus 1 Year FortiGuard Unified Threat Protection (UTP) and...	$1,008.87	Buy on Amazon
2		WatchGuard Firebox T45-PoE Network Security/Firewall Appliance (WGT47000-US+WGT470063)	$947.29	Buy on Amazon
3		Ubiquiti Unifi Security Appliance (USG), Single,White	$164.99	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

What an “open port” means on a VPS

Ubuntu defines an open port as “a network port bound to a service and actively listening for incoming connections or packets.” That definition describes a process waiting on a socket; it does not automatically mean the service is reachable from the public internet. Reachability also depends on the address the process binds to and on upstream filtering.

Ubuntu has followed a “No Open Ports” policy since Ubuntu 6.06 LTS (Dapper Drake): a default installation should not expose listening network services where they are unnecessary. Cloud images are a practical exception to the apparent rule. Providers commonly include OpenSSH so that a customer can administer the new machine, which is why TCP port 22 often appears immediately after provisioning.

#1 Best Overall

FortiGate-60F Network Security Appliance Plus 1 Year FortiGuard Unified Threat Protection (UTP) and FortiCare Premium (FG-60F-BDL-950-12)

• HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
• UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
• OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
• RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
• EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.

$1,008.87

Buy on Amazon

The useful question is therefore not “Is this port number normal?” but “What is listening, where is it listening, and does the workload require public access?” A socket on 127.0.0.1 or [::1] is reachable only from the VPS itself. A socket on 0.0.0.0 or [::] listens on all addresses for that IP family and can be reachable externally if a provider firewall and the guest firewall permit it.

Inventory listeners before you close anything

Start with a non-destructive inventory. The first command shows listening TCP and UDP sockets:

ss -utln

To associate each socket with the owning process, run the privileged form:

sudo ss -utlnp

Read the output as a set of decisions rather than as a list of numbers. Record the protocol (TCP or UDP), local address, port, and process name. A TCP listener and a UDP listener on the same number are separate rules. A service bound to loopback is a different exposure from one bound to a wildcard address.

Make an inventory table for the machine you are securing. Include the service’s purpose, who needs to reach it, whether that access is public or private, and whether the provider firewall currently allows it. Do not stop a process simply because its port is unfamiliar; identify the process first with sudo ss -utlnp and, if necessary, inspect the service configuration or package that owns it.

Which listeners are commonly normal?

The table describes roles, not a promise that every image will contain them. A minimal image may show only SSH; a preconfigured application image may add several listeners. No reliable prevalence percentage exists for “normal” new-VPS ports, so classify your own inventory instead of comparing it with an invented average.

Why the bind address changes the risk

For each listener, compare the local address in ss with the intended audience.

• 127.0.0.1:PORT is IPv4 loopback. Only processes on the VPS can connect.
• [::1]:PORT is IPv6 loopback and has the same host-only property for IPv6.
• 0.0.0.0:PORT accepts IPv4 connections on all local interfaces, subject to firewall rules.
• [::]:PORT accepts IPv6 connections on all local interfaces, subject to firewall rules. Depending on the system’s dual-stack behavior, IPv4 handling may be separate, so test both families.

A database needed only by a local API can usually bind to loopback rather than a wildcard address. A public website must listen on an address reachable by clients, but that does not mean every administrative or database port should also be public. Treat “public” and “listening” as separate properties when reviewing a configuration.

Enforce least privilege at two layers

Use the provider’s security group or cloud firewall as the outer filter and the VPS firewall as the local filter. Ubuntu’s security guidance recommends limiting traffic that can reach open ports and closing ports that are not needed. The two layers should express the same intent, so an accidental local rule does not create exposure that the provider layer was meant to prevent.

Provider firewall or security-group rules

Create ingress rules only for services that must be reachable. Cloud documentation commonly illustrates selective rules such as tcp:22, tcp:80, and tcp:443; those are examples of protocol-and-port rules, not a recommendation to open all three on every VPS.

Rank #2

WatchGuard Firebox T45-PoE Network Security/Firewall Appliance (WGT47000-US+WGT470063)

• WatchGuard Firebox T45 tabletop appliances bring enterprise-level network security to small office/branch office and retail environments. These appliances are small-footprint, cost-effective security powerhouses that deliver all the features present in WatchGuard’s higher-end UTM appliances, including all security capabilities, such as AI-powered anti-malware, threat correlation, and DNS-filtering.
• 5G and Wi-Fi 6 enabled models available. Up to 3.94 Gbps firewall throughput, 5 x 1Gb ports, 30 Branch Office VPNs
• Zero-touch deployment makes it possible to eliminate much of the labor involved in setting up a Firebox to connect to your network - all without having to leave your office. A robust, Cloud-based deployment and configuration tool comes standard with WatchGuard Firebox appliances. Local staff connects the device to power and the Internet, and the appliance connects to the Cloud for all its configuration settings.
• Firebox T45 models make network optimization easy. With integrated SD-WAN and optional 5G technology, you can ensure failover to the cellular network, minimize disruptive connectivity, and establish secure and reliable connections for small offices.
• Standard Support includes 24x7 access to technical support, with an unlimited number of incidents with a targeted response time of 24 hours for low priority, 8 hours for medium priority, 4 hours for high priority, and live calls for critical priority. Support is Web-Based and Phone-Based.

$947.29

Buy on Amazon

• Allow SSH only from the administration network when feasible, rather than from every IPv4 and IPv6 address.
• Allow HTTP or HTTPS only when the application is intentionally public.
• Do not add DNS, DHCP, database, or game-application ports until you have identified the clients that require them.
• Review IPv4 and IPv6 separately. A rule that protects one address family may not protect the other.

Guest firewall rules

The guest firewall gives you a local enforcement point and documents the intended exposure next to the service. On Ubuntu, UFW is a practical interface for this job. It does not replace stopping an unused daemon or changing a wildcard bind address; it filters traffic while the process may still be listening.

Close ports safely with UFW

Use an existing session or a provider console while changing firewall policy. The dangerous mistake is enabling UFW before allowing the SSH path you are currently using.

1. Confirm how you are connected

Write down whether your session uses SSH, which address family it uses, and whether an intermediate bastion or provider console is involved. If SSH is restricted to a trusted network, record that source address or range before editing rules.

2. Add the SSH allow rule first

For a broadly reachable SSH service, the basic rule is:

sudo ufw allow 22/tcp

When you can restrict administration to a known source, use a source-specific rule instead:

sudo ufw allow proto tcp from TRUSTED_IP to any port 22

Replace TRUSTED_IP with the actual address or network you control. Do not remove the broader rule until you have tested the restricted path in a separate session.

3. Add only required public services

If the VPS hosts a public HTTP service, allow its required ports explicitly:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Do not add these rules merely because the numbers are common. If no website or API needs them, leave them closed and remove any existing allowance.

4. Enable UFW only after checking the rule set

Inspect the numbered rules before activation:

sudo ufw status numbered

Confirm that the current SSH path appears, along with only the services you deliberately selected. Then enable UFW using the normal command for your system and confirm the resulting status. Keep the provider console available until you have verified a new SSH connection.

5. Delete an unnecessary allowance

You can remove a rule by repeating its specification:

Rank #3

Sale

Ubiquiti Unifi Security Appliance (USG), Single,White

• Integration with Unifi Controller. Powerful firewall performance
• Convenient VLAN support. QoS for enterprise VoIP
• VPN server for secure communications. 10/100/1000Base-T
• 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
• Refer instruction manual for troubleshooting steps.

$164.99

Buy on Amazon

sudo ufw delete allow PORT/PROTO

For example, an obsolete HTTP allowance would be removed with the equivalent port and protocol specification. You can also delete by the number shown in the status output:

sudo ufw delete NUMBER

Numbers can change after deletions, so run sudo ufw status numbered again before deleting another numbered entry. If both TCP and UDP rules exist, remove each protocol that is not required.

6. Stop or rebind the service itself

A firewall rule is not the same as a closed service. If an application is no longer needed, stop it through its service manager and prevent it from starting again according to that application’s administration procedure. If it is needed only locally, configure it to bind to 127.0.0.1 and/or [::1] instead of a wildcard address, then restart it using the application’s documented method. Re-run sudo ss -utlnp to confirm the listener changed as intended.

Validate every change from inside and outside

Validation has three separate questions: is a process still listening, does the guest firewall allow it, and can an appropriate external client reach it?

1. Run sudo ss -utlnp again. Confirm that a removed service no longer appears, or that a retained service is bound only to the intended address.
2. Run sudo ufw status verbose. Check that the active policy contains the expected ports, protocols, source restrictions, and IPv6 coverage.
3. Review the provider security-group or cloud-firewall rules. Remove an outer-layer allowance that no longer has a matching workload.
4. From an appropriate external vantage point, test only the ports you expect to be reachable. Test IPv4 and IPv6 separately when both are assigned. A failed connection can mean the service is stopped, the bind address is private, the guest firewall blocks it, or the provider firewall blocks it; use the three preceding checks to distinguish those cases.
5. Open a fresh administration session before closing the original one. This catches an SSH rule that looked correct but does not match the actual source address or address family.

Do not call a port “closed” merely because a firewall rule was deleted. The service may still be listening on a private interface, and a different provider rule or network path may still expose it. State the result precisely: stopped, loopback-only, filtered by UFW, filtered by the provider, or externally reachable.

A practical decision process for a new game-server VPS

Game servers often add application-specific UDP or TCP listeners, while administrators still need SSH and may run a website or monitoring endpoint. Use this sequence before opening a game port:

1. Identify the process. Match the game daemon to its socket with sudo ss -utlnp.
2. Define the players’ network. Decide whether the service is public, limited to a private team network, or reachable only through a VPN or other private path.
3. Choose the protocol. Permit the exact TCP or UDP protocol the game requires; do not open both by habit.
4. Set the bind address. Use a public address only when players must connect directly. Bind to a private or loopback address when another local proxy or tunnel is the intended entry point.
5. Mirror the intent. Add the narrow provider rule and the matching UFW rule, including IPv6 only if the game service and players use it.
6. Test with a real client. Verify login, gameplay traffic, and administration independently. A game that starts locally can still be unreachable because one firewall layer lacks the required protocol.

Common failure modes and recovery

SSH stopped working immediately after enabling UFW

Use the provider’s web console, serial console, or rescue access if available. Inspect sudo ufw status numbered, add an allow rule matching the actual SSH protocol, source, port, and address family, then test a new session before disconnecting the console. If SSH is listening only on a nonstandard port, allow that port rather than assuming 22.

The port is listed by ss but external tests fail

Check the bind address first. Loopback listeners are intentionally host-only. For a wildcard listener, inspect both UFW and the provider firewall, then verify that the test uses the correct protocol and IP family. A UDP service will not respond to a TCP-only test.

The firewall rule is gone but the port still appears

Deleting an allow rule does not stop the daemon. Stop or reconfigure the owning service, then run sudo ss -utlnp again. If the listener is required locally, rebind it to loopback and leave the external firewall closed.

IPv4 is protected but IPv6 remains reachable

Compare the provider rules, UFW status, and listeners for both families. A wildcard IPv6 bind such as [::]:PORT and an IPv6 ingress rule can expose a service even when the corresponding IPv4 rule is absent. Decide explicitly whether IPv6 is part of the service’s audience and apply the same least-privilege policy.

New-VPS verification checklist

• Run ss -utln, then sudo ss -utlnp, and record every listener.
• Classify each socket by service, protocol, bind address, and required audience.
• Keep SSH available through the administration path you actually use before changing firewall policy.
• Allow only required ingress in the provider security group or cloud firewall.
• Mirror those decisions in UFW, with source restrictions for SSH where feasible.
• Remove rules for unused services and stop or rebind the services themselves.
• Check both IPv4 and IPv6.
• Re-run the socket and firewall inventories after changes.
• Test from an external vantage point and open a fresh SSH session.

Bottom line

TCP 22 is usually an expected administration listener on a new cloud VPS because OpenSSH is commonly preinstalled. Ports 80 and 443 are normal only for an intentionally public web workload; DNS, DHCP, database, and game-service listeners require a role-based decision. Inventory first, distinguish loopback from wildcard binds, restrict ingress in both the provider firewall and UFW, and verify the actual service and external reachability after every change.

Quick Recap

Bestseller No. 1

FortiGate-60F Network Security Appliance Plus 1 Year FortiGuard Unified Threat Protection (UTP) and FortiCare Premium (FG-60F-BDL-950-12)

$1,008.87

Bestseller No. 2

WatchGuard Firebox T45-PoE Network Security/Firewall Appliance (WGT47000-US+WGT470063)

$947.29

SaleBestseller No. 3

Ubiquiti Unifi Security Appliance (USG), Single,White

Integration with Unifi Controller. Powerful firewall performance; Convenient VLAN support. QoS for enterprise VoIP

$164.99

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.