Network exposure
Keep private services private
Restrict databases, dashboards, metrics, queues, and control panels to local or private access with their own authentication.
8 minute lesson
Operational interfaces often reveal more power and data than the public application. Do not expose them merely because they have a login screen.
Use loopback, private networking, VPN access, provider firewalls, or an authenticated tunnel. Keep service authentication enabled. Review cloud firewall and host firewall together so one layer does not create a false sense of safety.
A database login page is still an exposed parser and authentication service. VPN or tunnel access adds operational dependency, but removes routine internet traffic from the interface.
Test both network layers independently. The provider firewall limits paths before packets reach the host, while the host firewall protects against mistakes or traffic arriving through another interface.
Administer the lab database through loopback, a VPN, or an authenticated tunnel. Scan its public address and prove the database port is closed while local authentication still rejects a wrong password.
Lesson completed