How does ufw and lightsail firewall interact with each other

The Lightsail firewall and UFW (Uncomplicated Firewall) on your instance are two separate layers of security that work independently but can affect each other's effectiveness if not properly configured.

The Lightsail firewall operates at the network level and controls traffic that reaches your instance through its public IP address. It's managed through the Lightsail console and is always active, regardless of the operating system you're using.

UFW, on the other hand, is an operating system-level firewall that runs on your instance itself. It's commonly used on Ubuntu and Debian systems, but it's not automatically disabled on Lightsail instances.

When you reset UFW, it likely reverted to its default configuration, which typically blocks incoming connections unless explicitly allowed. This is why your HTTP and HTTPS communications were blocked, affecting services like Grafana and JupyterHub.

To ensure proper functionality, you need to configure both firewalls:

1. The Lightsail firewall should be set to allow incoming traffic on the necessary ports (e.g., 80 for HTTP, 443 for HTTPS).

2. UFW on your instance should also be configured to allow these same ports.

It's not always necessary to have an exact sync between Lightsail firewall and UFW rules, but they should be complementary. A common practice is to use the Lightsail firewall for broad traffic control and UFW for more granular, instance-specific rules.

If you want to rely solely on the Lightsail firewall, you could disable UFW on your instance. However, using both provides an additional layer of security. Just remember that if a port is blocked by either firewall, the traffic won't reach your application.

To avoid future issues, whenever you make changes to one firewall, consider the impact on the overall security setup and adjust the other firewall if necessary. This ensures your instance remains secure while allowing the required traffic for your applications to function properly.

Sources
Control instance traffic with firewalls in Lightsail - Amazon Lightsail
Troubleshoot connection errors | AWS re:Post
Community | Securing Wordpress on Lightsail: Lock Down Your Server