@levelsio: Take Your VPS Off the Public Internet Now
Cloudflare Tunnel for the site, Tailscale for the server, then empty the firewall.
“It doesn’t matter you have SSH key login, this is about exploits and vulnerabilities AI is finding.”
@levelsio reposted his VPS advice “now that everyone is getting hacked.” There are two ways into a VPS, he writes: through your site or app, like this week’s PHP file upload exploit, or through the server, like SSH or an open port.
| Layer | What to do |
|---|---|
| Site or app | Put it on a Cloudflare Tunnel; the free plan has WAF on by default, and the server stops answering on ports 80 and 443 |
| Server | Put it on a Tailscale network, reachable only from your own devices |
| Firewall | Switch off all regular access. On Hetzner, create a new firewall and empty it, then test it |
Tailscale and Cloudflare Tunnel still get in because they go outbound, making a tunnel to the outside. That shrinks the attack surface to those two, “much safer, not perfect btw, but nothing is.”
Both are 100% free, he adds, and Tailscale is based on open source WireGuard, so you can have your agent set that up instead if you would rather not depend on a company.
Sources
- @levelsio on X · Oct 23, 4:03 AM PT
- @levelsio on X · Oct 23, 4:43 AM PT
- @levelsio on X · Oct 23, 4:43 AM PT
- @levelsio on X · Oct 23, 5:09 AM PT