Agent WranglersNetworking and DNS Required
Close admin ports to the internet
Never open SSH, RDP, database or admin ports to the internet. Reach machines through an identity-aware tunnel or a private network that needs single sign-on.
How to do it
Use a tool that checks who you are before it opens a path. Examples are AWS Systems Manager Session Manager and Google Cloud IAP. A VPN such as Tailscale or WireGuard behind single sign-on also works. Log each session. On one rented server without such a tool, allow SSH only from fixed admin addresses, as in the host firewall rule.
Example
# From a machine outside your network
nmap -Pn -p 1-65535 --open shop.example.comHow to check
A port scan from outside of every public address finds only 80 and 443 open, plus 25 on mail servers.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/no-public-admin-ports.