Network Isolation & Zero-Trust

Because the RasnuOS agent operates entirely on outbound polling, you can architect your infrastructure using strict Zero-Trust network principles.

The Ideal Firewall Configuration

For maximum security, we recommend configuring your cloud provider's firewall (AWS Security Groups, DigitalOcean Cloud Firewalls) with the following rules:

Inbound Rules (Ingress)

• ALLOW TCP 80 / 443: Only if this specific server is hosting a public web application.
• DENY TCP 22 (SSH): Completely block SSH access. It is no longer needed.
• DENY ALL OTHERS: Drop all other inbound traffic.

Outbound Rules (Egress)

• ALLOW TCP 443: Required for the RasnuOS Agent to poll the control plane (https://os.rasnu.com).
• ALLOW UDP 53: Required for DNS resolution.
• ALLOW TCP 80/443: Required if your applications need to make external API calls.

Air-Gapped Environments & VPCs

For highly regulated industries (Finance, Healthcare), servers are often placed in private Subnets/VPCs with no direct access to the public internet.

RasnuOS fully supports this architecture. You can route the agent's outbound polling traffic through a single, highly monitored NAT Gateway or Forward Proxy (like Squid). The agent will securely tunnel its mTLS connection through the proxy to reach the RasnuOS Control Plane, ensuring your internal servers remain completely isolated from the public internet.