---
title: "Networking and DNS · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/networking-and-dns
updated: 2026-10-20
licence: "All rights reserved"
---

# Networking and DNS

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Keep databases private, open only the ports you name, close admin ports to the internet, limit outbound traffic, force TLS and keep DNS in code.

The network decides what can reach what. A database with a public address or one open port undoes every other rule. These rules set the defaults for cloud networks, firewalls and DNS. Certificates, HTTPS settings and DNS signing for a website live in the [hosting and network chapter](https://agentwranglers.se/playbook/website/hosting-and-network).

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/networking-and-dns`.

## Required

- [Keep databases in private subnets](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/private-data-stores): Put every database, cache and queue in a private subnet with no public address. Only the app's own security group may reach it.
- [Deny all traffic unless a rule allows it](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/deny-by-default-firewall): Start every security group and firewall from deny. Allow only named ports from named sources, and open a port to the whole internet only on the load balancer.
- [Close admin ports to the internet](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/no-public-admin-ports): Never open SSH, RDP, database or admin ports to the internet. Reach machines through an identity-aware tunnel or a private network that needs single sign-on.
- [Force encryption on every managed service](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/enforce-tls-on-services): Configure every database, cache and bucket to refuse plain connections. Make every client check the server's certificate.
- [Require tokens for the metadata service](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/metadata-service-tokens): Make every cloud server's metadata service answer only requests that carry a session token. Allow the token to travel one network hop, or two when containers on the host need it.
- [Keep DNS records in code](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/dns-as-code): Manage every DNS record of every domain in code, changed by pull request. Never edit a record in the provider's web panel.

## Recommended

- [Limit where servers can send traffic](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/egress-control): Let servers send traffic only to the hosts they need. Databases send none to the internet at all.
- [Shorten the TTL before you move a record](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/lower-ttl-before-changes): Before you point a name at a new server, shorten its TTL and wait one full old TTL. Restore the longer TTL after the move.

- Previous: [Configuration and secrets](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets)
- Next: [Policy as code](https://agentwranglers.se/playbook/infrastructure/policy-as-code)
- [All chapters](https://agentwranglers.se/playbook/infrastructure)