port scanning the droplet internally (from the droplet) gives the expected
PORT STATE SERVICE
22/tcp open ssh
3128/tcp open squid-http
but scanning remote from the host shows a discrepancy:
On Ubuntu, ufw isn't configured by default, thus any port could show up as open, filtered, etc. You'd need to configure the firewall specifically to suit your needs if you only want specific ports open.