Securing VPS Infrastructure: Hardening Servers with Tailscale and Cloudflare Tunnel
Developer @levelsio shares a practical VPS security guide recommending the removal of public internet exposure by closing all inbound ports and routing manageme
Image source: Cloudflare Docs, Figure 5 — Secure application delivery
Virtual Private Servers (VPS) connected directly to the public internet face constant brute-force attacks and vulnerabilities discovered by automated scanners and AI tools. Developer Peter Levels (@levelsio) emphasizes that SSH key authentication alone is no longer enough and recommends taking servers completely off the public internet.
Closing Inbound Ports via Outbound Tunnels
The core principle of securing a VPS is shutting down all inbound listening ports. Attackers scanning external IP addresses should find no open web ports (80 or 443) or standard entry points responding to public traffic.
Instead, use a private Tailscale network for administration and Cloudflare Tunnel for web traffic. Cloudflare's cloudflared daemon initiates outbound connections to Cloudflare, allowing web requests to reach the service without publicly exposing inbound web ports on the server. Tailscale provides private connectivity between authorized devices.
Private Server Management with Tailscale
Server administration and SSH access should be restricted entirely to a private Tailscale network. Tailscale creates a secure mesh VPN connecting only trusted personal devices—such as a laptop or phone—to the VPS.
When provisioning a new VPS, install Tailscale and confirm private access before closing public inbound SSH port 22. Manage the server over its Tailscale network, verifying a recovery path before applying restrictive firewall rules.
Isolating Web Traffic with Cloudflare Tunnel
For hosting websites or web applications, traffic should flow exclusively through Cloudflare Tunnel rather than exposing direct web ports on the VPS.
When the site is proxied through Cloudflare, the available Free plan protections and WAF rules can be applied at the edge. The protection provided depends on the rules enabled and service configuration. Visitors reach the service through Cloudflare while Cloudflare Tunnel removes the need to open public inbound web ports on the origin.
Conclusion
Exposing a VPS directly to the open internet invites malicious scanning. Restricting administration to Tailscale and routing public web traffic through Cloudflare Tunnel can reduce a server's exposed attack surface.
Original source
- Original source: @levelsio on X
- Official architecture image and supporting documentation: Cloudflare Docs — Secure application delivery (Figure 5)
- Private SSH access reference: Tailscale — Tailscale SSH