> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hyperbolic.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Securing Open Ports

# How to Secure Open Ports on `us-central-1` Bare Metal machines

This guide explains how to restrict public access to open ports on a bare-metal cluster from `us-central-1` while still allowing secure intra-cluster communication between nodes.

***

## Overview

By default, Linux servers often expose services to the public Internet (e.g., SSH or RPC).\
We’ll configure a host-based firewall (`ufw`) so that:

* Only your personal machine can connect via SSH (port 22)
* Cluster nodes can communicate with each other internally (via private IPs)
* All other public traffic is blocked

***

## Prerequisites

* Root or `sudo` access to each server
* The private IP range of your cluster (e.g. `10.0.0.0/24`)
* Your own public IP address (from your local machine)

To get your (local) IP:

```bash theme={null}
curl ifconfig.me
```

Example output:

```
203.0.113.25
```

***

## Step-by-Step Instructions

### 1. Verify open ports

Check which ports are currently listening:

```text theme={null}
sudo ss -tulnp
```

Look for any entries bound to `0.0.0.0` or `[::]` — these are publicly accessible.\
Common culprits include:

* `22/tcp` → SSH
* `111/tcp` and `111/udp` → RPCBind (can be disabled if unused)

***

### 2. Disable unnecessary services (optional)

If `rpcbind` or other network daemons are running and not required:

```shell theme={null}
sudo systemctl disable --now rpcbind
sudo systemctl disable --now rpcbind.socket
```

***

### 3. Install and enable UFW

If not already installed:

```shell theme={null}
sudo apt update
sudo apt install ufw -y
```

***

### 4. Configure default firewall policy

Deny all inbound connections except for explicitly allowed ports:

```shell Shell theme={null}
sudo ufw default deny incoming
sudo ufw default allow outgoing
```

***

### 5. Allow SSH from your personal machine

Replace `203.0.113.25` with your own IP:

```shell Shell theme={null}
sudo ufw allow from 203.0.113.25 to any port 22 proto tcp
```

This ensures only your computer can SSH into the node.

***

### 6. Allow internal cluster communication

If your cluster uses a private subnet (e.g., `10.0.0.0/24`), you'll need to allow internal access. For each of your cluster's nodes, you'll need to get the Private IP for each node. Replace `10.0.0.0` with each of your node's Private IP.

```bash theme={null}
# Example: allow SSH and service ports inside the cluster
sudo ufw allow from 10.0.0.0/24 to any port 22 proto tcp
sudo ufw allow from 10.0.0.0/24 to any port 16000 proto tcp
sudo ufw allow from 10.0.0.0/24 to any port 6666 proto tcp
```

> Adjust the ports above as needed for your own services.

***

### 7. Block unwanted services

Explicitly deny unused or vulnerable ports:

```bash theme={null}
sudo ufw deny 111/tcp
sudo ufw deny 111/udp
```

***

### 8. Enable the firewall

```bash theme={null}
sudo ufw enable
```

You’ll be prompted to confirm:

```
Command may disrupt existing SSH connections. Proceed with operation (y|n)?
```

Press `y` to continue.

> ⚠️ **Keep your current SSH session open** until you confirm that your rules work.

***

### 9. Verify firewall configuration

```bash theme={null}
sudo ufw status verbose
```

Example output:

```
To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    203.0.113.25
22/tcp                     ALLOW IN    10.0.0.0/24
16000/tcp                  ALLOW IN    10.0.0.0/24
6666/tcp                   ALLOW IN    10.0.0.0/24
111/tcp                    DENY        Anywhere
111/udp                    DENY        Anywhere
```

***

### 10. Test SSH access

1. Open a **new terminal** on your local machine.
2. Try connecting via SSH:
   ```bash theme={null}
   ssh ubuntu@<server_public_ip>
   ```
3. Once confirmed, close the original SSH session.

***

## Summary

After completing this guide, your bare-metal cluster will:

* Allow controlled SSH access from your machine and internal peers
* Block all public exposure of unused ports
* Maintain secure and predictable network behavior across nodes