Written 27 Aug 2026. This is a how-to, not a product card. Buy links are not tagged yet.

See which doors the leftover box left open

Before you turn on the firewall, ask which ports are already listening.

Before you turn the firewall on (or wider), ask which ports the leftover box is already listening on. A listening port is a door the leftover box left open for house programs (SSH is usually 22, DNS for Pi-hole is 53, Samba uses a few share ports). ss -tuln prints those doors without needing extra packages.

Skip until SSH from the couch works

If ping fails and SSH hangs, start with is the leftover box still on? If you have never logged in from the couch, that is SSH from the couch. Prefer this look after the password change and keys are boring: change the leftover-box login password, log in with a key, and turn off leftover-box password login once the key works. This note assumes you can log in from the couch.

What this is

A look, not a shopping trip. Before turn on a simple firewall without locking yourself out, see what is already listening so you know which doors the firewall should allow. Do not forward those ports on the router. That boundary is keep the leftover box on the house network.

Ask which doors are open

SSH in from the couch, then ask:

ss -tuln

Point at the column that says Local Address:Port. Expect OpenSSH on 22. If Pi-hole is installed, expect 53. If a Samba share is up, expect something around 139 and 445. Surprises matter more than memorizing every line. You are not buying a switch for this look.

Optional: see which program owns the door

If your user can sudo and you want process names next to the ports:

ss -tulnp

That form may need sudo. Keep it optional. The plain list without process names is enough for the firewall look.

What the look means

Expected house doors (SSH, maybe DNS, maybe Samba) means you can proceed to turn on a simple firewall without locking yourself out. Weird public-looking listeners mean stop. Do not open the router. Read when something broke, look at the leftover-box log and see if any house jobs failed to start. Never solve surprises by port-forwarding.

What next

Firewall: turn on a simple firewall without locking yourself out. Guess slowdown later: slow down password guesses on SSH. House boundary: keep the leftover box on the house network.

Skip

• Skip if SSH fails. That is is the leftover box still on? or SSH from the couch.
• Skip a rack firewall for this look.
• Skip forwarding port 22 on the router.
• Skip buying a Protectli.
• Skip Proxmox tonight. That is what a VM is, and when you do not need one.
• Skip opening Samba to the internet.