One rather specific thing that may or may not apply to you, but I see very often on Ubuntu servers: Docker containers completely bypass UFW rules (the default

One rather specific thing that may or may not apply to you, but I see very often on Ubuntu servers: Docker containers completely bypass UFW rules (the default firewall on Ubuntu Server). Even if a port isn't open, if a docker forwards it to a container it will be acceptable from the outside. So if you're running Docker, make sure your container port forwards are only bound to localhost (apart from the ones you want to expose intentionally of course) and/or that you use the appropriate patches/scripts that fix this issue (there's a few different ways floating around the web).