What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For a normal internet-facing Ubuntu LAMP server, expose only TCP 80 for HTTP and TCP 443 for HTTPS to the public internet. Allow SSH on the port your server actually uses (22 by default) only from trusted administrator addresses, a VPN, bastion host, or management subnet. Keep MySQL on TCP 3306 bound to localhost or a private interface; a single-host LAMP installation should not publish it publicly.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The practical rule is minimum reachability: a process must be listening, the listener must be bound to an externally reachable address, and the firewall must allow only the networks that need access.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
Port decisions at a glance
The table below separates the conventional port number from the exposure that a particular deployment needs. A port number alone does not make a service reachable: the daemon, bind address, host firewall, and any cloud or datacenter firewall all matter.
| Service | Typical port | When it is public | Recommended scope |
|---|---|---|---|
| HTTP / Apache | TCP 80 | When the site serves plain HTTP or redirects HTTP requests to HTTPS | Public if HTTP is part of the site flow; otherwise close it |
| HTTPS / Apache TLS | TCP 443 | When visitors connect securely to the website | Public for a TLS-enabled website |
| SSH / OpenSSH | TCP 22 by default, or the configured alternative | Only for administration | Trusted IPs, a VPN, bastion host, or management subnet |
| MySQL | TCP 3306 | Normally never | Loopback for a single host, or only required private application hosts |
Do not open a port merely because a package installed it or because a scanner reports that it is conventional. Ubuntu security guidance describes an unnecessarily open port as one exposed to an untrusted network without a need, or one belonging to an unused service. Each such listener expands the attack surface.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Why least exposure is the correct starting point
Ubuntu’s security documentation says a new installation should have no listening network services by default, with only rare exceptions. Apache and OpenSSH become exceptions only when you intentionally deploy them. Start with a written service map: which users connect, from where, over which protocol, and to which process. Then permit exactly those paths.
There are three separate questions for every candidate port:
- Is a process listening? A firewall rule cannot make an absent service work.
- What address is it bound to? A listener on 127.0.0.1 or ::1 is local-only; a listener on 0.0.0.0 or an externally routed IPv6 address can accept remote traffic.
- Which networks does the firewall permit? Public, private-subnet, VPN, and single-address rules have very different risk profiles.
Apply the same analysis to IPv4 and IPv6. A rule that looks correct for IPv4 does not automatically prove that an IPv6 path is closed, and a service bound to all IPv6 addresses may be reachable even when its IPv4 counterpart is restricted.
Web traffic: TCP 80 and TCP 443
TCP 80 for HTTP
Open TCP 80 publicly when Apache must accept HTTP requests. This includes sites that intentionally serve non-encrypted content and sites that use HTTP only to issue a redirect to HTTPS. If Apache is configured exclusively for HTTPS and another controlled mechanism handles redirects, port 80 can remain closed; test the intended user journey before removing it.
Opening 80 does not encrypt traffic. Credentials, cookies, and other sensitive data should not be sent over plain HTTP. A common design is to listen on 80 long enough to redirect every request to the canonical HTTPS URL, while serving the application itself on 443. The redirect is an application and web-server policy, not a reason to expose any database or administration port.
TCP 443 for HTTPS
Open TCP 443 publicly when Apache terminates TLS and serves the website securely. This is the normal public entry point for a modern LAMP site. Certificate issuance, renewal, HTTP-to-HTTPS redirects, and browser access all depend on the exact web-server configuration, so verify that Apache is listening on the expected address and virtual host before changing firewall rules.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Do not substitute an arbitrary high port for 443 just to hide the service. Clients, certificate tools, monitoring systems, and reverse proxies commonly expect standard HTTPS. Security comes from correctly configured TLS, patching, authentication, and restricted administration rather than from obscuring the web port.
SSH: administration, not application traffic
Use the configured SSH port
Open the TCP port named by the active sshd configuration. TCP 22 is the default and is the port used in Ubuntu’s basic firewall example, but an administrator may have changed it. Before adding a rule, inspect the effective SSH configuration and confirm that you have a second way into the machine or an existing session in case a rule is wrong.
Changing 22 to another number can reduce indiscriminate scanning noise, but it is not a substitute for access control. The decisive control is the source network allowed to reach SSH.
Restrict sources instead of publishing SSH
If administrators have fixed office, VPN, or bastion addresses, permit only those sources. A source-restricted UFW rule has the form sudo ufw allow proto tcp from <trusted-network> to any port 22; replace both the network and port with your real values. For a VPN design, allow the VPN address range rather than every internet address. If a bastion is used, permit the bastion’s address and require administrators to connect through it.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhen a dynamic residential address makes a permanent allow-list impractical, use a VPN or another managed access network rather than opening SSH to the world by default. Keep key-based authentication, disable unused accounts, and apply normal OpenSSH patching and logging practices. These controls protect the administrative channel; they do not change which ports Apache or MySQL need.
Confirm the rule will not lock you out
Maintain the current SSH session while testing. Add the new rule before removing the old one, verify a fresh connection from an approved source, and only then delete obsolete access. If your provider supplies an out-of-band console, keep its credentials available for recovery. A firewall reload that succeeds syntactically can still block the only route to the server.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
MySQL: keep TCP 3306 private
Single-host LAMP deployment
In the common arrangement where Apache, PHP, and MySQL run on one Ubuntu host, the application can reach MySQL through a Unix socket or loopback. MySQL therefore has no reason to accept packets from the internet. Bind it to localhost, commonly 127.0.0.1 (and the appropriate local IPv6 address if used), and do not create a public UFW allow rule for 3306.
A loopback bind means a remote scanner cannot reach the database even if a firewall rule is accidentally broad. It also prevents a database account or protocol mistake from becoming a direct internet service. Confirm the actual bind setting in the MySQL server configuration and restart only after checking the file for syntax and distribution-specific paths.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Multi-host application and database
If the web or application tier is on another machine, TCP 3306 may be required, but it should still be private. Bind MySQL to a private interface and allow only the specific application host or a narrowly defined application subnet. Do not use 0.0.0.0 as a convenience when one address or subnet is sufficient. If traffic crosses an untrusted or shared network, configure encrypted database connections and verify certificate and identity checks; a private route alone is not encryption.
Never confuse an application requirement with a public requirement. The application host needs a route to the database, while arbitrary internet clients do not. If a managed database, container network, or cloud security group is involved, apply the same source restriction in every layer.
Choose rules by deployment architecture
| Architecture | Public ingress | Private or restricted ingress | Ports to avoid exposing publicly |
|---|---|---|---|
| One Ubuntu host running Apache, PHP, and MySQL | 80 and 443 as required by the site | SSH from administrator network | 3306 and every unused daemon |
| Separate web and database hosts on one private network | 80 and 443 on the web host | SSH from management network; 3306 from the web host or application subnet | 3306 from the public internet |
| Web host behind a reverse proxy or load balancer | Only the proxy’s required public listeners | 80/443 from the proxy to Apache as designed; SSH from management network | Direct public access to backend and database listeners |
| Maintenance-only server with no public website | None unless a specific service requires it | SSH through VPN, bastion, or management subnet | 80, 443, 3306, and unused services |
The table describes traffic destinations, not a command sequence. In a proxy design, the backend’s source rule must match the proxy addresses, and the proxy itself may be the only machine that needs public 80 or 443.
Configure UFW without guessing
Ubuntu identifies Uncomplicated Firewall (UFW) as its default firewall configuration tool. Make changes from an existing trusted session, keep your SSH port and source network known, and use the dry-run option where available.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
- Inspect the current policy. Run
sudo ufw status verbose. Note whether UFW is active, the default incoming policy, existing source restrictions, and both IPv4 and IPv6 status. - List application profiles. Run
sudo ufw app list, then inspect a profile withsudo ufw app info <profile>. Profiles can represent OpenSSH or web-server rules, but read the profile before enabling it so you know which ports and protocols it contains. - Allow administration first. For the default SSH port, the basic rule is
sudo ufw allow 22. Prefer the restricted formsudo ufw allow proto tcp from <trusted-network> to any port 22. If SSH uses another port, substitute that configured port. - Allow the web paths that the design needs. Use an HTTP profile or a dry run such as
sudo ufw --dry-run allow httpbefore applying a TCP 80 rule. Add TCP 443 for HTTPS when TLS is served on this host. If the site deliberately does not accept HTTP, do not add 80 solely because it is conventional. - Do not add a public MySQL rule for a local database. A local-only database normally needs no UFW ingress rule. For a split deployment, create a TCP 3306 rule whose source is the exact application host or private subnet, and document why it exists.
- Enable or reload only after reviewing. Apply the approved rules, then run
sudo ufw status verboseagain. Confirm that an allow rule did not accidentally cover every source or both protocols when only TCP was intended.
UFW is the host firewall, not a replacement for provider security groups, hardware firewalls, or Apache’s own access controls. Where multiple filtering layers exist, the final path must be permitted at every layer, while a deny at any layer can block it.
Verify real listeners with ss
Firewall rules show what packets may pass; they do not show what programs are actually listening. Run sudo ss -utlnp to list listening TCP and UDP sockets and their owning processes. The options include numeric addresses and ports, listening sockets, and process information.
- Find Apache listeners and record whether they are on 0.0.0.0:80, [::]:80, 0.0.0.0:443, or the corresponding specific addresses.
- Find the SSH listener and compare its port with the rule you intend to allow.
- Find MySQL and check whether it is on 127.0.0.1:3306, a private address, or a wildcard address. A wildcard bind deserves review even if UFW currently blocks it.
- Look for unexpected listeners such as development servers, management panels, caches, or container-published ports. Identify the owning process before deciding whether to stop, disable, reconfigure, or firewall it.
Filter loopback and private addresses separately when assessing exposure. A process listening only on loopback is not externally reachable through that interface, whereas a process on all interfaces may be reachable through a provider network path that you did not intend.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Bind addresses, IPv6, and layered firewalls
Binding determines where a daemon accepts connections. Apache commonly needs all web-facing addresses, while MySQL usually needs only loopback or a private address. OpenSSH should bind to the management interfaces that administrators actually use. Explicit binds make accidental exposure less likely than wildcard binds.
Check both address families. Apache or OpenSSH may listen on IPv6 even when you have tested only IPv4. Ensure UFW’s IPv6 setting matches your policy, and test from an IPv6-capable external network if the server has a globally routed IPv6 address. Conversely, do not disable IPv6 blindly if it is part of the site’s intended reachability; restrict it consistently instead.
Cloud security groups, provider firewalls, container networking, and upstream load balancers can publish or block ports independently of UFW. Document the intended path from client to process and inspect each control plane when behavior differs from the host’s local rules.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Troubleshoot common port questions
“The website does not load after opening 443.”
Check that Apache is running and actually listening on 443 with sudo ss -utlnp. Confirm that the TLS virtual host and certificate configuration loaded successfully, that UFW permits TCP 443, and that any provider firewall also permits it. Test the server’s public IPv4 and IPv6 addresses separately; a single address family may be misconfigured.
“Do I need 3306 open because PHP uses MySQL?”
No, not for a same-host application. PHP can use a Unix socket or loopback without public ingress. Only a separate application host needs 3306, and then the source should be limited to that host or private subnet with encrypted database transport where appropriate.
“SSH works locally but not remotely.”
Compare the configured SSH port with the UFW rule, then inspect the listener’s bind address. Verify that your source IP is inside the allow-list and that an upstream firewall is not blocking the port. If the server has IPv6, test whether the client is resolving an IPv6 address that lacks the corresponding rule.
“A scanner reports an open port I did not allow.”
Use sudo ss -utlnp to identify the process and address, then inspect UFW and any provider or container firewall. Stop or disable an unused service, rebind a required service to loopback or a private interface, or add a narrow source rule. Do not silence the finding by changing the port number without removing the unnecessary listener.
“I changed the SSH port and lost access.”
Use an existing session or out-of-band console to inspect the effective sshd configuration and listening sockets. Restore a known-good rule for the configured port, test a new connection, and remove obsolete rules only after access is confirmed. Keep a second administration path during future changes.
Operational review checklist
- List intended public services and confirm that only HTTP and HTTPS are public where the site requires them.
- Record the actual SSH port and restrict its source to administrators, VPN users, a bastion, or a management subnet.
- Verify that MySQL is loopback-only on a single host or private-subnet-only in a multi-host design.
- Run
sudo ss -utlnpafter installing or enabling services and investigate every unexpected listener. - Review
sudo ufw status verbose, application profiles, IPv4 rules, and IPv6 rules after firewall changes. - Check provider security groups, reverse proxies, container port publishing, and upstream firewalls in addition to UFW.
- Revisit the map after software upgrades, migrations, new virtual hosts, or network changes; remove rules when the service that justified them disappears.
Canonical’s security guidance captures the governing principle: limit traffic that can reach open ports with a firewall and close ports that are not necessary. On an Ubuntu LAMP server, that normally means public 80 and 443, tightly controlled SSH, and no public MySQL.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
