UFW blocks all incoming ports, except a few that I opened.
In auth.log I see a lot of attempts to get in through closed ports. Like:
Connection closed by 52.167.224.94 port 40030 [preauth]
This port should be closed by UFW. Why does it appear in auth.log? Is this a security risk? Is there a good web page where I can read more about this subject.