Sheet 03 · The no-open-ports story
The server that never answers the door.
Run a port scan against our infrastructure and you get the most boring result in security: nothing. Beacon nodes expose zero inbound ports to the internet — because all of their traffic travels through tunnels they opened themselves.
How a website works with no doors open.
You don’t need to be an engineer to follow this. Three steps, no jargon:
The node dials out
Each beacon node places one outgoing, encrypted call to Cloudflare — like phoning a trusted switchboard. It initiates the connection; nothing initiates a connection to it.
The line stays open
That single call is kept alive around the clock. There is no listening doorbell, no exposed address to scan, no port for a stranger to try.
Everything rides that line
When a visitor requests your site, Cloudflare passes the request down the already-open line and the response travels back the same way. The internet only ever talks to the switchboard.
Watch one request get through
Three stamps, or it doesn’t travel.
Every request is encrypted, filtered, and authenticated — in that order — before a beacon node ever sees it. Watch the packet earn its passage.
A planet-sized bouncer works our front of house.
DDoS absorbed at the edge
Flood attacks crash against Cloudflare's global network — capacity measured in hundreds of terabits — long before they could ever reach a 35-watt node.
TLS on every hop
Traffic is encrypted from the visitor's browser to the edge, and again inside the tunnel to the node. There is no unencrypted leg to eavesdrop on.
Cache where it counts
Static assets are served from the edge city nearest your visitor. Beacon nodes only do the work that's genuinely dynamic.
A room of its own.
Beacon nodes sit on a fully isolated network segment. They cannot see — and cannot be seen by — any other device. Even in the worst imaginable case, there is nowhere to go: no shared drives, no neighboring machines, no lateral moves.
Responsible disclosure
Security researchers: if you believe you’ve found a weakness anywhere in this model, we genuinely want to hear it — and we’ll respond personally.
[email protected]Hardening schedule — maintained, not marketed
- PORTS
- Zero inbound. The tunnel is outbound-only; there is nothing to scan.
- PRIVILEGE
- Every service runs as its own least-privileged account. Nothing runs as root that doesn't have to.
- UPDATES
- Security patches are applied promptly and automatically — fleet-wide automation means nothing waits in a queue.
- BACKUPS
- Nightly backups are stored off-node, so no single machine — ours included — is a single point of loss.
- SURFACE
- Each node runs what it needs to serve your site and nothing else. Less software, fewer holes.
Revision A — Open for clients
Security by subtraction.
No open ports, no shared segments, no mystery. If you'd like your site behind a model this quiet, we'd love to show you around.
Next sheet · 04
Thirty-five watts, honestly