Written 25 Aug 2026. This is a how-to, not a product card. Buy links are not tagged yet.

Turn on a simple firewall without locking yourself out

After SSH from the couch works, allow OpenSSH, then turn on ufw. The leftover box stays reachable. Surprise inbound ports do not.

This is a small safety step for a box that is already working. Allow the door you use first. Then turn on the guard.

Skip until SSH works

If you cannot log in with SSH from the couch, stop. Fix that first. Password SSH should already work. A key is optional, but logging in with a key is a nice next step once the password login is boring.

What ufw is

ufw is a simple on/off firewall on Debian and Ubuntu. It blocks surprise inbound ports that you did not mean to leave open. It is software on the leftover box, not a new appliance, and it is not pfSense. SSH must be allowed before you turn it on or you can lock yourself out.

Allow SSH first

While you are logged into the leftover box, run:

sudo ufw allow OpenSSH

This makes an exception for SSH before the firewall starts blocking inbound connections. If the OpenSSH profile is not available, sudo ufw allow 22/tcp is the direct version. The order matters. Allow first, enable second.

Turn it on

Now enable ufw:

sudo ufw enable

It warns that existing SSH connections may be disrupted. Because OpenSSH is already allowed, type yes and press Enter. Then check:

sudo ufw status

You should see Status: active and an OpenSSH rule marked ALLOW. Keep the current SSH window open while you test a second login from the laptop.

If you lock yourself out

Plug a screen and keyboard into the leftover box, log in at the console, and run sudo ufw disable. Then fix the SSH rule and try again. Do not solve this by opening port 22 on the router. SSH stays inside the house, as explained in keep the leftover box on the house network.

Samba or Pi-hole may need another rule

If you already run a file share or Pi-hole, those services may need their own local-network rules later. For a first enable on a box with only SSH, OpenSSH is enough.

What next

Once a week, keep the leftover box updated. That is enough for now. Do not buy a firewall appliance for this job.

Skip

• Skip a new Protectli.
• Skip fail2ban on day one.
• Skip disabling password login this pass.
• Skip forwarding port 22 on the router.
• Skip buying a rack firewall.