NS7 vs NS8 requirements based on hosted cloud VPS only

[davidep (Davide Principi)]

In this scenario you install the single node on the VPS and the built-in firewall is enough.

As said:

@giacomo

NS8 has a built-in firewall

@robb

I would like some thoughts on best practices to install and run NS8 on a VPS.
Especially having security and massive attempts and probes for open ports etc.

Probe attempts can be blocked/mitigated with

1. Crowdsec application (released)
2. Change of ssh default port (documented here NS8 Change node SSH port 22 permanently - #15 by davidep)
3. Limit HTTP access from certain IPs (planned and documented here How do I prevent the administration page from being accessible from the Internet? - #2 by davidep)

[robb (Rob Bosch)]

1: I will install that after migrating services
2: already done and confirm this works on a Debian 12 host for NS8
3. Since I do not have a dedicated IP address to work from so unfortunately this is not an option for me

[LayLow]

@davidep

Limit HTTP access from certain IPs

I would love to see a reverse option. Block all except, so disallow all except for IP(rang, regex, geo) and/or only allow access when connected via VPN. So only available on 'green, not on red, that would be a nice option too based on per module/app basis

[LayLow]

@robb

I do not have a dedicated IP address to work from so unfortunately this is not an option

Agree, hence the suggested VPN only option.