My webserver and database server are separate. All I've done to secure the webserver is used
ufw and denied from all except ports 22, 80, and 443. What else really needs to be done there?
On my database server, I only allow from ports 22 and the port the database (mysql) listens on. This made me wonder. Usually I just allow all traffic. In the case of a database, I've usually made strict "users" and said things as far as the software goes like "only let user@internal_ip_address access the database". But should this be a firewall thing? Or both? It seems like if the firewall only allows traffic to port 22 and to 3306 from my webserver's internal ip address, that should be good enough? Do you do both just out of "good practice"?
What other general firewall rules should I be setting for these?