there are many different solutions to secure a cassandra cluster. One of them is to enter public IPs and open the 7000/9042 port on each sever.

Another one is to have everything in a private network with private IPs and connect the nodes with some kind of VPN solution. I have OPNsense with Wireguard for this, but I'm wondering if this makes any problems in production.

What are you guys using to prevent attacks on public ports?

Thank you so much.

1 Answer 1


If you care about your data, do not EVER put a database server on a public network. There is no preventing attacks on public ports. Databases are secured from most direct attacks by placing them behind firewalls, and using web servers and application servers (also protected by firewalls and load balancers) to reverse proxy user requests for information. No one should ever connect directly to a database or its server directly over the Internet. A database server or cluster, directly exposed on a public network, is begging to be hacked and its contents stolen.

  • 1
    good links, and everything is correct. I am aware of the security issues, but I was not talking about open unsecured public exposure of the cassandra port. My option would be to have all security measures in cassandra set right (encryption, authentication) and then to open the port on the public ip (so that it can talk to other members in the cluster) or not to be super strict about security and let the vpn between cassandra servers do the job.
    – mulesky
    May 8, 2020 at 8:22
  • Thanks for the clarification. :)
    – pmdba
    May 8, 2020 at 13:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.