[chmln]

Yeah, the documentation isn't great. However,

> block everything, allow this handful of ports

This is trivial.

  ufw default deny incoming
  ufw allow 22