# No open port, even under a scan

Cloud galaxy · Cédric Merlin, CTO · https://merlin-cedric.fr/en/cloud/zero-port/

A secure, sovereign infrastructure for a startup with no ops team: under a scan, no open port on the application server.

## The problem

A startup needs a secure, sovereign infrastructure, with nobody to run it.

## The constraint

Two small servers, and no private network provided by the host.

## What I did

1. **An encrypted private network.** I connect the machines with an encrypted private network (NetBird, WireGuard).
2. **One entry, outbound.** The public arrives through a tunnel that starts from the server and goes out (Cloudflare Tunnel): nothing listens on the internet.
3. **Everything closed by default.** The firewall denies everything by default. You connect only with a key, and only from the private network.
4. **Rebuilt in one command.** I describe everything in Ansible: a lost server is rebuilt in one command.

## The result

Under a scan, the application server shows no open port.

Figure: 0 open ports on a scan of the application server.

## Stack

Ansible, NetBird, WireGuard, Cloudflare Tunnel, nftables, Docker, restic

---
Page: https://merlin-cedric.fr/en/cloud/zero-port/ · Contact: contact@merlin-cedric.fr