# Ensure Droplet Is Not Publicly Accessible

- Source: https://support.icompaas.com/support/solutions/articles/ensure-droplet-is-not-publicly-accessible
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [DigitalOcean Cloud](https://support.icompaas.com/support/solutions/c_do_cloud) › [DigitalOcean Rules](https://support.icompaas.com/support/solutions/folders/digitalocean-rules)
- Last updated: 2026-08-13
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

DigitalOcean Droplets can be configured with public networking, which provides a publicly reachable IPv4 or IPv6 address. A Droplet that does not require direct internet connectivity should be configured as a Private Droplet, with public networking disabled. Private Droplets have no public network interface or public IP address and communicate through VPC networking.

  

Rationale:

Exposing a Droplet directly to the public internet increases its attack surface and allows internet-based attackers to attempt connections to services running on the Droplet. Private Droplets restrict network access to resources within the VPC and approved private connectivity paths.

  

Impact:

Removing public networking prevents direct internet access to the Droplet. Applications that require public access should instead be exposed through an appropriate public-facing resource, such as a Load Balancer, while keeping the backend Droplet private.

For example:

1.  A web application can use a public Load Balancer with the application Droplet accessible only through the VPC.
    
2.  An administrative server can be accessed through a private bastion host rather than exposing SSH directly to the internet.
    

  

Default Value:

By default, DigitalOcean Droplets are created with public networking enabled. During Droplet creation, the Public IPv4 option is selected by default.

  

Pre-Requisite:

1.  Log in to DigitalOcean with sufficient permissions to manage Droplets.
    
2.  Identify Droplets that do not require direct public internet access.
    
3.  Record the current public IP, VPC, and network configuration for backout.
    
4.  Ensure an alternative private access path is available if required.
    

  

Remediation:

Configure Droplets that do not require direct internet access as Private Droplets. DigitalOcean Private Droplets have no public network interface and no public IP address.

For existing Droplets where public networking cannot simply be removed, create a new Private Droplet using the required image/snapshot and migrate the workload to it.

  

Test Plan:

Via the DigitalOcean Control Panel

1.  Log in to the DigitalOcean Control Panel.
    
2.  Go to Droplets.
    
3.  Select the Droplet being audited.
    
4.  Open the Networking section.
    
5.  Check the Droplet's network interfaces and IP addresses.
    
6.  Verify that the Droplet does not have:
    

-   A public IPv4 address.
    
-   A public IPv6 address.
    
-   A publicly accessible Reserved IP.
    

  

CLI / API Test

List all Droplets:

doctl compute droplet list

For a specific Droplet:

doctl compute droplet get <droplet\_id>

Using the DigitalOcean API:

curl -s \\  
  -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" \\  -H "Content-Type: application/json" \\  "https://api.digitalocean.com/v2/droplets/<droplet\_id>"

Review the networks.v4 and networks.v6 sections.

A public IPv4 interface will contain:

{  
  "type": "public",  "ip\_address": "203.0.113.10"}

  

Implementation:

Via the DigitalOcean Control Panel

For new Droplets:

1.  Go to Create → Droplets.
    
2.  Select the required image, region, and Droplet size.
    
3.  Expand the Networking section.
    
4.  Clear the Public IPv4 address.
    
5.  Ensure the Public IPv6 address is also disabled.
    

6.  Select the required VPC Network.
    
7.  Verify that the Control Panel displays the Private Droplet notice.
    
8.  Create the Droplet.
    

  

DigitalOcean states that a Private Droplet is reachable only through another resource with public access in the same VPC, such as a bastion host or Load Balancer.

  

API / CLI Implementation

When creating a new Droplet, set public\_networking to false and ipv6 to false.

Example API request:

curl -X POST \\  
  -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" \\  -H "Content-Type: application/json" \\  "https://api.digitalocean.com/v2/droplets" \\  -d '{    "name": "private-droplet",    "region": "blr1",    "size": "s-1vcpu-1gb",    "image": "ubuntu-24-04-x64",    "vpc\_uuid": "<vpc\_uuid>",    "public\_networking": false,    "ipv6": false  }'

The DigitalOcean API supports public\_networking: false, which creates the Droplet with private networking only and prevents assignment of public IPv4 or IPv6 addresses.

Equivalent doctl creation:

doctl compute droplet create private-droplet \\  
  --region blr1 \\  --size s-1vcpu-1gb \\  --image ubuntu-24-04-x64 \\  --vpc-uuid <vpc\_uuid> \\  --enable-monitoring

  

Important: Do not treat simply attaching a Cloud Firewall as equivalent to making a Droplet private. A Cloud Firewall restricts traffic, but a Droplet can still have a public IP. DigitalOcean specifically distinguishes Cloud Firewalls from private networking.

  

Backout Plan:

If public connectivity is required for the workload:

1.  Create or use an appropriate public-facing network architecture.
    
2.  Recreate the Droplet with public networking enabled.
    
3.  Configure the required Cloud Firewall rules.
    
4.  Validate application connectivity.
    
5.  Update DNS or Load Balancer configuration as required.
    

For a newly created Droplet, public networking can be enabled by setting:

{  
  "public\_networking": true,  "ipv6": false}

Example:

curl -X POST \\  
  -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" \\  -H "Content-Type: application/json" \\  "https://api.digitalocean.com/v2/droplets" \\  -d '{    "name": "public-droplet",    "region": "blr1",    "size": "s-1vcpu-1gb",    "image": "ubuntu-24-04-x64",    "vpc\_uuid": "<vpc\_uuid>",    "public\_networking": true,    "ipv6": false  }'

Note that public\_networking is a Droplet creation setting; DigitalOcean documents it as controlling whether the Droplet is created with public networking. It should not be assumed that an existing public Droplet can simply be converted to a private Droplet through a normal update operation.

  

References:

1.  [DigitalOcean — How to Create a Droplet](https://docs.digitalocean.com/products/droplets/how-to/create/?lang=net&utm_source=chatgpt.com)
    
2.  [DigitalOcean — Droplets API Reference](https://docs.digitalocean.com/products/droplets/reference/api/droplets/?utm_source=chatgpt.com)
    
3.  [DigitalOcean — Cloud Firewalls](https://docs.digitalocean.com/products/networking/firewalls/?utm_source=chatgpt.com)
    
4.  [DigitalOcean — How to Configure Firewall Rules](https://docs.digitalocean.com/products/networking/firewalls/how-to/configure-rules/?utm_source=chatgpt.com)
    
5.  [DigitalOcean — VPC Networking](https://docs.digitalocean.com/products/networking/vpc/how-to/add-resources/?utm_source=chatgpt.com)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.