Auditing what your own servers expose with nmap: a defensive playbook
Firewall rules describe what you meant to expose; a scan from outside shows what you actually expose. This is the repeatable nmap routine we run against our own hosts, including the Docker port that slipped past ufw and how we diff results week to week.