Best firewall baseline for OrbitOS edge devices?

[tiago.netops]

Hi all,

For production deployments, what baseline firewall profile are you using on OrbitOS nodes?

I am aiming for:
- deny by default
- explicit allowlist for app ports
- remote management only via VPN

Any recommended defaults from the team?