# Firewall Security Guide

This guide details the firewall configuration (`ufw`) for the project. It provides commands to reset the firewall, set default block policies, and allow only the required ports for this project.

---

## 1. Set Default Policy (Block All Incoming, Allow All Outgoing)

Run these commands to block all incoming traffic by default and allow all outgoing traffic. This ensures that any port not explicitly allowed will be blocked.

```bash
# Set default to deny all incoming traffic
sudo ufw default deny incoming

# Set default to allow all outgoing traffic
sudo ufw default allow outgoing
```

---

## 2. Allow Only Required Ports for this Project

Run the following commands to explicitly allow only the ports needed for SSH and the services mapped in this project:

```bash
# 1. SSH Access (Crucial: do not lock yourself out of the server!)
sudo ufw allow 22/tcp

# 2. Web Server Ports (HTTP & HTTPS)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# 3. Node.js API Service Ports
sudo ufw allow 3000/tcp
sudo ufw allow 4000/tcp
sudo ufw allow 5000/tcp
```

---

## 3. Disallow / Delete Unused Allowed Ports

Your server currently allows ports `8080` and `2000`, which are not used by this project. Run these commands to delete those rules:

```bash
# Delete rule for port 8080
sudo ufw delete allow 8080

# Delete rule for port 2000
sudo ufw delete allow 2000/tcp
```

---

## 4. Enable and Verify the Firewall

Once you have configured the rules, enable the firewall and check its status:

```bash
# Enable the firewall (press 'y' when prompted)
sudo ufw enable

# Check active status and verbose rules
sudo ufw status verbose
```