FragNode Production Hardening Checklist: Zero Exposed Internal Ports

1. Binding AMP Instance Manager + srcds_run Strictly to Loopback & WireGuard Interfaces

Publishing Docker or daemon ports with 0.0.0.0 bypasses UFW rules by rewriting iptables nat chains directly, exposing internal AMP Instance Manager + srcds_run sockets to internet-wide scanners.

Bind internal listeners explicitly to 127.0.0.1 or your wg0 private subnet inside GameUserSettings.ini, exposing only ports 80 and 443 through a hardened TLS 1.3 reverse proxy.

Publishing container ports with -p 8080:8080 silently rewrites Linux iptables nat chains and bypasses UFW completely, exposing AMP Instance Manager + srcds_run admin endpoints to automated internet scanners within 90 seconds of boot.

# FragNode Loopback Socket Audit, UFW Lockdown & SSH Hardening
# Verify zero internal AMP Instance Manager + srcds_run sockets leak on 0.0.0.0
ss -tulpn | grep -v '127.0.0.1'
sudo ufw default deny incoming && sudo ufw allow 443/tcp && sudo ufw allow in on wg0
sudo sshd -T | grep -E 'passwordauthentication|permitrootlogin|pubkeyauthentication'

2. Ed25519 SSH Keys, CrowdSec Bouncers & DDoS Filtering

Disable PasswordAuthentication in sshd_config and deploy lightweight CrowdSec nftables bouncers consuming under 95MB RAM even on 8GB starter nodes.

Both Hostinger Game Panel EPYC ($11.99/mo) and UltaHost Dedicated EPYC VDS ($37.50/mo) provide upstream volumetric DDoS mitigation so malicious SYN floods never saturate your 64 concurrent players capacity.

Bind internal listeners explicitly to 127.0.0.1:PORT or your wg0 WireGuard interface inside GameUserSettings.ini, run CrowdSec nftables bouncers (< 90MB RAM), and rely on Hostinger Game Panel EPYC / UltaHost Dedicated EPYC VDS upstream DDoS filtering.

3. Secrets Isolation & Non-Root Execution Policy

Run AMP Instance Manager + srcds_run under an unprivileged UID with read-only root filesystems where supported, mounting only the World-save NVMe atomic fsync directory writable.

4. Production-Grade Guardrails Around GameUserSettings.ini

Game main loops are single-thread bound: 2.2GHz shared cores plus default Java Stop-The-World garbage collection paused ticks for 420ms while UDP query floods spiked packet loss.

Owning an isolated 16GB Hostinger AMP Game Panel VPS ($11.99 monthly) or 32GB UltaHost VDS ($37.50 monthly) gives full root sysctl tuning, pre-generated chunks on NVMe, and zero slot taxes.

Rotate API tokens quarterly and never commit plaintext credentials alongside GameUserSettings.ini repositories.

5. Operational Hardening & Migration Checklist (15.6 ms tick)

Run through every item below on your 16GB Hostinger Game Panel EPYC or UltaHost Dedicated EPYC VDS instance before routing live FragNode user traffic:

• Standard web firewalls cannot stop Layer-7 UDP A2S_INFO or RakNet amplification floods; public FiveM and Rust communities need inline game-aware DDoS scrubbing in Singapore or Frankfurt.
• Many Xeon core-count bargains run at 2.1GHz base clock, starving single-threaded Minecraft 50ms tick budgets and CS2 sub-tick frame deadlines even while 14 cores sit idle.
• Pre-generate Minecraft world borders with Chunky during off-hours so weekend exploration reads cached NVMe files instead of pegging CPU.
• Tune sysctl net.core.rmem_max=26214400 and wmem_max=26214400 on Linux game hosts to eliminate UDP micro-stutter.

6. FragNode Troubleshooting & Capacity Planning FAQ

What VPS tier does FragNode recommend for Attack Surface Reduction (0 Public Admin/DB Sockets) at 64 concurrent players?

We recommend a 16GB DDR5 NVMe KVM node (Hostinger Game Panel EPYC at $11.99/mo) with NetServerMaxTickRate=128 configured in GameUserSettings.ini. Once sustained load approaches 128 concurrent players, step up to 32GB on UltaHost Dedicated EPYC VDS ($37.50/mo).

How do I verify World-save NVMe atomic fsync will not bottleneck AMP Instance Manager + srcds_run (15.6 ms tick)?

Run fio 4K fsync write tests alongside iostat -xz during peak hours; unthrottled PCIe Gen4 arrays hold 115,000 IOPS with write_await below 2.5ms, keeping FragNode well inside its 15.6 ms tick SLA.

When should a FiveM or Rust community step up from Game KVM to UltaHost VDS?

Once public servers attract rival L7 UDP floods or pass 40 concurrent players with heavy OneSync scripts, we recommend UltaHost VDS 32GB ($37.50 monthly) for zero-steal physical RAM and 150Gbps+ DDoS filtering.

Can we migrate AMP Instance Manager + srcds_run later without losing data or rewriting GameUserSettings.ini?

Yes. Keeping GameUserSettings.ini declarative in Git and streaming encrypted ZSTD backups of World-save NVMe atomic fsync lets you cut over between Hostinger Game Panel EPYC and UltaHost Dedicated EPYC VDS over WireGuard with under 60 seconds of DNS switchover.