Hetzner Cloud servers receive a public IPv4 and IPv6 address by default. The machine is on the internet before you have logged into it, which means securing it is not a step you do after configuration, it is the first step.
Two layers of firewall
Cloud Firewalls are applied at the platform, outside the server. Traffic blocked here never reaches the machine, so a misconfigured service or a compromised host cannot expose a port you closed.
Host firewalls such as nftables or ufw run on the machine itself. They are useful for fine-grained rules and defence in depth, but they are inside the boundary.
Use both. Cloud Firewall as the primary boundary, host firewall as a second layer.
A sensible default policy
- Deny all inbound by default.
- Allow SSH only from your own address or a bastion, never from the whole internet.
- Allow 80 and 443 only on machines that genuinely serve public traffic.
- Keep databases off the public interface entirely and reach them over the private network.
- Apply firewalls by label so new servers inherit the policy automatically instead of being forgotten.
That last point matters more than it sounds. Most exposure incidents are a machine that was created outside the process.
Private networks
A private network gives your servers an internal subnet that public traffic cannot reach. The standard pattern:
- Application servers hold public IPs and serve traffic.
- Databases, caches and internal services have no public exposure and listen only on the private interface.
- Traffic between servers stays internal rather than hairpinning through public addresses.
Bind services to the private interface explicitly. A database configured to listen on all interfaces is publicly reachable even on a private network, unless the firewall stops it.
Floating IPs
A Floating IP can be reassigned between servers. It is the simplest failover primitive available: point it at a standby, and traffic follows without waiting for DNS to propagate.
It is also useful for zero-downtime replacement, where you build a new server, verify it, then move the address.
SSH hardening
- Key authentication only; disable password login.
- Do not use the root account for daily access.
- Restrict SSH by source address in the Cloud Firewall.
- Add fail2ban or equivalent if any exposure is unavoidable.
These apply to any provider. The wider sequence is in the day one security checklist.
Mail and port 25
Outbound SMTP is restricted by default on Hetzner. Our Hetzner listings include an open port 25 configuration, which is for running a real mail server. Hetzner ranges carry mixed sending reputation because of their popularity, so authentication records and IP warming matter more here than on a premium range. See the port 25 guide.
Common questions
Do Cloud Firewalls cost extra?
Cloud Firewalls are provided as part of the platform. Check current terms for any limits.
Can I remove the public IP?
Servers can be created without public IPv4 and reached via another host on the private network.
Does the private network cross regions?
Private networks are regional. Cross-location traffic needs a different approach.