I have 2 severs and 12 systems (All having UBUNTU) connected to each other over LAN. The 12 systems use multiple databases (Redis/Postgres etc.) hosted on the 2 servers using LAN. Now, I need to connect the system to the internet as these systems and servers call some external APIs and cloud based databases etc. from time to time.
From outside world (over the internet) I only need SSH access to the systems for monitoring purpose etc.
My setup has all the 14 (2+12) system connected to LAN using static IP via a switch and 1 connection from switch to a router (which has connection to internet).
Inside the router, I have forwarded 14 ports, some obscure ones (range 20000 and above) and redirected them individually to port 22 of each LAN IP.
I have already enabled automatic silent security updates in the systems.
The questions are:
a) Do I need to block unused ports(apart from the ones used by them for internal use) in the 14 systems via UFW or it is not required given my situation?
b) Do I need to take care of anything else from security perspective, that I might have missed?
I am totally new to this security and setup part. Kindly advise.