Containing lateral movement of a compromised machine is hard

Before doing anything else , consider if you actually need to expose anything to the internet at all. Running a VPN would let you reduce your exposed service to 1 port ( wireguard is UDP based so it’s harder to test if the port is open too ). A VPN like NetBird / tailscale / Cloudflare warp don’t need you to open any ports at all

Except for services that absolutely must be open to the internet ( like my Tor Relay ) I access everything via NetBird