Skip to main content

​
How to Secure Open Ports on us-central-1 Bare Metal machines

This guide explains how to restrict public access to open ports on a bare-metal cluster from us-central-1 while still allowing secure intra-cluster communication between nodes.

​
Overview

By default, Linux servers often expose services to the public Internet (e.g., SSH or RPC).
We’ll configure a host-based firewall (ufw) so that:
  • Only your personal machine can connect via SSH (port 22)
  • Cluster nodes can communicate with each other internally (via private IPs)
  • All other public traffic is blocked

​
Prerequisites

  • Root or sudo access to each server
  • The private IP range of your cluster (e.g. 10.0.0.0/24)
  • Your own public IP address (from your local machine)
To get your (local) IP:
Example output:

​
Step-by-Step Instructions

​
1. Verify open ports

Check which ports are currently listening:
Look for any entries bound to 0.0.0.0 or [::] — these are publicly accessible.
Common culprits include:
  • 22/tcp → SSH
  • 111/tcp and 111/udp → RPCBind (can be disabled if unused)

​
2. Disable unnecessary services (optional)

If rpcbind or other network daemons are running and not required:

​
3. Install and enable UFW

If not already installed:

​
4. Configure default firewall policy

Deny all inbound connections except for explicitly allowed ports:
Shell

​
5. Allow SSH from your personal machine

Replace 203.0.113.25 with your own IP:
Shell
This ensures only your computer can SSH into the node.

​
6. Allow internal cluster communication

If your cluster uses a private subnet (e.g., 10.0.0.0/24), you’ll need to allow internal access. For each of your cluster’s nodes, you’ll need to get the Private IP for each node. Replace 10.0.0.0 with each of your node’s Private IP.
Adjust the ports above as needed for your own services.

​
7. Block unwanted services

Explicitly deny unused or vulnerable ports:

​
8. Enable the firewall

You’ll be prompted to confirm:
Press y to continue.
⚠️ Keep your current SSH session open until you confirm that your rules work.

​
9. Verify firewall configuration

Example output:

​
10. Test SSH access

  1. Open a new terminal on your local machine.
  2. Try connecting via SSH:
  3. Once confirmed, close the original SSH session.

​
Summary

After completing this guide, your bare-metal cluster will:
  • Allow controlled SSH access from your machine and internal peers
  • Block all public exposure of unused ports
  • Maintain secure and predictable network behavior across nodes