To lock down a self-hosted vector database or inference port, bind it to a private interface, firewall everything except the one port you intend to expose, put an authenticating reverse proxy in front, turn on authentication where the tool supports it, and verify from outside your network. Do not rely on obscurity or a default port.
Why these services get exposed
Tools built for fast local experimentation often listen on all interfaces and ship with no authentication, because they assume a trusted network. Then they are deployed to a cloud host with a public address. The vLLM guide notes that some of its internal channels, such as the torch.distributed TCP store, listen on all interfaces by default and should be firewalled. Ray's documentation says anyone who can reach the dashboard, jobs, or client ports can run arbitrary code and that network isolation is expected.
OWASP's 2025 list includes vector and embedding weaknesses (LLM08:2025), where weak access control on a vector store lets one user retrieve another's data.
Checklist
- List listening ports on every host, and map each to a service and owner.
- Bind to private addresses. Set the host or interface option explicitly instead of trusting defaults.
- Default deny at the firewall or security group. Allow only the proxy port from the internet, and internal ports from named hosts.
- Front it with a proxy that authenticates users and allowlists routes. vLLM recommends this because its API key does not cover every route.
- Enable the tool's own authentication as a second layer. Ray notes token authentication is defense in depth, not a replacement for network isolation.
- Disable dev and admin features such as dev mode endpoints and dashboards in production.
- Enforce tenant filters in the query, not in the client. See permission aware retrieval for multi tenant stores.
- Encrypt traffic between nodes where the tool does not, using a sidecar or the network layer.
- Verify from outside. Scan your public addresses from a machine that is not on your network and confirm only the expected port answers.
- Alert on new open ports so drift is caught.
What to test after changes
Try an unauthenticated request to each route, including metrics and health routes. Try to read another tenant's vectors with a valid user token. Both should fail.
A short note on Safeguard
Safeguard offers asset discovery and API and web scanning that help find exposed services and test them. Try a free scan at gold.safeguard.sh/scan.
Quick check
Is a non default port enough protection?
No. Scanners find open ports quickly. Use firewall rules and authentication.
Is TLS enough for a cluster port?
Ray's documentation says TLS does not replace network isolation. Use both where possible.
Sources
Last reviewed: 19 October 2026.
