Skip to content

Step 8 — Close the Public Door

Why it matters: you have been securing the door. This removes the door from the street entirely. The only way to reach the server now is to be a device you personally put on your tailnet.

In the Hetzner console, create a Firewall, attach it to your server, and allow no inbound traffic — specifically remove any rule allowing inbound port 22.

Tailscale connects outbound, so this does not break it.

Confirm the Tailscale name still connects with Tailscale running, and that the raw public IP now fails.

Both results are what you want. Getting only the first is not proof of anything.

If this step makes you nervous, it is reasonable to leave it a week and come back once connecting over Tailscale feels routine.

Steps 1 through 7 already put you ahead of most business servers on the internet.

Install Claude Code on the Server