Best firewall baseline for OrbitOS edge devices?

[tiago.netops]

Hi all,

For production deployments, what baseline firewall profile are you using on OrbitOS nodes?

I am aiming for:
- deny by default
- explicit allowlist for app ports
- remote management only via VPN

Any recommended defaults from the team?

[PR1000]

Good question. Recommended baseline from our side:

1) default deny inbound
2) expose only required service ports
3) keep SSH disabled unless break-glass access is needed
4) route admin operations through VPN + audit logs

We are preparing a hardening checklist and can publish it in Security soon.