---
title: "Close admin ports to the internet · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/no-public-admin-ports
updated: 2026-10-20
licence: "All rights reserved"
---

# Close admin ports to the internet

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns)
- Rule: Never open SSH, RDP, database or admin ports to the internet. Reach machines through an identity-aware tunnel or a private network that needs single sign-on.
- How: Use a tool that checks who you are before it opens a path. Examples are AWS Systems Manager Session Manager and Google Cloud IAP. A VPN such as Tailscale or WireGuard behind single sign-on also works. Log each session. On one rented server without such a tool, allow SSH only from fixed admin addresses, as in the [host firewall rule](https://agentwranglers.se/playbook/infrastructure/servers/host-firewall).
- Check: A port scan from outside of every public address finds only 80 and 443 open, plus 25 on mail servers.

Example:

```sh
# From a machine outside your network
nmap -Pn -p 1-65535 --open shop.example.com
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/no-public-admin-ports`.

- Previous: [Deny all traffic unless a rule allows it](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/deny-by-default-firewall)
- Next: [Limit where servers can send traffic](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/egress-control)
- [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns)