Skip to main content

Network security

Ports

Blocked ports

To protect the Selectel infrastructure from malicious network activity, we restrict access to certain TCP/UDP ports. Inbound and outbound traffic is blocked on border routers at the perimeter of the Selectel Internet network. An exception applies to TCP port 25 — only outbound traffic is blocked to restrict sending potentially malicious mail. You can view the list of blocked ports in the Blocked ports and Internet resources instructions.

Ports that are most often opened

22/TCP (SSH)Often subject to password mining attacks to connect to the server
3389/TCP (RDP)Often attacked due to weak passwords and system vulnerabilities
5900/TCP (VNC)Often attacked due to weak passwords
80/TCP (HTTP)Due to unencrypted data transmission, data is easily intercepted.
Frequently targeted by web application attacks, such as those using XSS or SQL injection
443/TCP (HTTPS)Despite data encryption, there may be vulnerabilities in SSL/TLS that could lead to data interception by attackers.
Frequently targeted by web application attacks, such as attacks using XSS or SQL injection
21/TCP (FTP)Due to unencrypted data transmission, data is easily intercepted
23/TCP (Telnet)Due to unencrypted data transmission, data is easily intercepted
445/TCP (SMB)Used by attackers to spread malware
3306/TCP (MySQL)Open access to MySQL can lead to data leaks
5432/TCP (PostgreSQL)Open access to PostgreSQL can lead to data leaks

Firewalling

Basic network protection

To protect your system, limit incoming and outgoing traffic. Define a list of required network services and for each of your servers, allow connections only to network ports that are associated with those services. If necessary, restrict the source address of the connection. All connections that are not explicitly allowed should be blocked.

Network security for private subnets and public IP addresses can be provided by:

Security groups in the cloud platform

Using security groups, you can configure filtering rules for all traffic passing through a cloud server port.

Advanced protection

Firewalls of the NGFW (Next Generation Firewall) generation analyze traffic to protect the network perimeter and provide the following capabilities:

  • IPS/IDS — an intrusion detection and prevention system;
  • proxy — a mode that allows you to manage user access to the internet from the corporate network according to a role-based access control model;
  • reverse proxy — a mode that allows you to safely publish internal company resources to the internet.

Selectel provides software and hardware firewalls, including FSTEC-certified ones. For example, the UserGate firewall is FSTEC-certified. Certified firewalls have additional options, such as L7 filtering — deep traffic inspection at layer 7 of the OSI model, which includes application control, SSL decryption, URL filtering, etc. These options are provided as subscriptions in addition to the base license.

Basic firewall functionality includes two types of VPN (Virtual Private Network):

  • site-to-site VPN — allows you to organize a tunnel between offices and branches of one company or to a partner's network for secure data exchange;
  • client-to-site VPN — allows you to organize secure remote access to corporate services and data via the internet.

GOST-VPN service

You can set up a secure channel with your network or your partner's network using the GOST VPN service. Channel encryption is performed using GOST algorithms. We will configure a certified ViPNet Coordinator hardware crypto gateway on the Selectel infrastructure side and take care of its administration. An important prerequisite is the presence of a ViPNet network on your or your partner's infrastructure side.

Network Attack Detection and Prevention (IPS)

To detect and prevent network attacks, we recommend using specialized solutions — Intrusion Prevention System (IPS).

The IPS module is available in the following firewalls:

Among the free tools that perform IPS functions, the most popular and functional are:

As a host-based intrusion detection system (Host-based Intrusion Detection System — HIDS), we recommend using Wazuh.

Server-level network protection

You can also protect network connections at the individual server level. On Linux servers, we recommend using:

  • Secret Net LSP and Secret Net Studio – FSTEC-certified security tools for Linux and Windows operating systems that protect virtual and physical servers from unauthorized access and network attacks on the host;
  • Uncomplicated Firewall (UFW) — a firewall configuration tool. It was developed for the Ubuntu distribution, but is also available for other distributions, such as Debian;
  • firewalld is a firewall management tool that is installed by default on Red Hat Enterprise Linux-based distributions, such as Fedora, CentOS, Alma Linux, Rocky Linux, and Oracle Linux. Learn more about configuration in the firewalld documentation and configuration examples in the Fedora documentation.

When configuring a firewall, keep in mind that some ports originally intended for specific services can be exploited by attackers for compromise. For example, 21/TCP (FTP), 22/TCP (SSH), 23/TCP (Telnet), and 3389/TCP (RDP) are dangerous because they are frequently targeted by brute-force attacks and vulnerability exploits. You can view the full list of such ports in the Most commonly opened ports table.

Network access to a Managed Database cluster

In Managed Databases, you can configure network access to the cluster. Users can only access the cluster itself — there is no access to cluster nodes since they are on the Selectel side. By default, in clusters with a public subnet, connections are allowed for all addresses if a login and password are provided. For a cluster in a private subnet, connections are allowed from the cluster subnet and from subnets connected to the cluster subnet via a cloud router. You can restrict the list of IP addresses allowed to access the database cluster. Learn more in the instructions for PostgreSQL, PostgreSQL for 1C, PostgreSQL TimescaleDB, PostgreSQL PGVector, MySQL semi-sync, MySQL sync, Redis, and Kafka.

DDoS protection

Selectel provides basic free infrastructure protection against DDoS attacks at the network and transport layers (L3-L4) — learn more in the Selectel DDoS protection instructions. Information about blocked attacks, network blocks, and blocked IP addresses can be viewed in the Control panel under Products → Network incidents. Learn more about the information you can monitor in the Network incidents section.

Solutions from our partners are also available, which implement advanced protection against DDoS attacks at L3-L4 and L7 levels:

Web application security

To protect web applications at the application layer (L7), we recommend using specialized solutions — Web Application Firewall (WAF).

Selectel provides several solutions for web application protection using WAF:

  • partner solution Curator;
  • a certified SolidWall WAF Professional — we provide it as a license, and the client performs administration independently.

Among the free tools that perform WAF functions, the most popular and functional are: