1. Introduction

Oracle Cloud’s Always Free Tier is incredibly powerful — but just because it’s free doesn’t mean it’s secure out of the box.
If you spin up a VCN, a VM, and a DB system without hardening the environment, you’re exposing yourself to attacks within minutes.

In this guide, I’ll walk you through exactly how I secure every Always Free Tier deployment for clients, students, and my own lab environments.

This method is lightweight, simple, and follows Oracle’s recommended architecture—perfect for beginners and small businesses building their first cloud presence.

2. What Problem This Solves

Most Free Tier users run into these issues:

• VM SSH port exposed to the whole internet

• Public subnet used when private would be better

• No NSGs (Network Security Groups)

• Security Lists left wide open

• No host-level firewall rules

• No monitoring alerts for security events

And yes, I’ve seen production systems running like this.

Let’s fix that.

3. Step-by-Step Guide

Step 1 — Create a Private VCN Layout

OCI Console → Networking → Virtual Cloud Networks → Create VCN

Recommended CIDR:

Subnets:

• 10.0.1.0/24 — Public Subnet (for LB / bastion)

• 10.0.2.0/24 — Private Subnet (for compute/db)

CLI Equivalent:

Step 2 — Replace Security Lists With NSGs

Security Lists apply to subnets → too broad
NSGs apply to resources → perfect for security

Create NSG for Compute

Rules to allow only:

• SSH from your home IP

• HTTP/HTTPS if you run a website

• MySQL only inside VCN

CLI Example:

Add ingress rule:

Step 3 — Harden Your Compute VM

SSH into your VM and run:

Disable password login:

Step 4 — Remove Public IP from Database

Never expose MySQL or HeatWave externally.

OCI Console → MySQL → DB →
Disable Public Access

Step 5 — Add a Bastion for Administrative Access

OCI Console → Bastion → Create Bastion
Attach to Public Subnet.

You now SSH using:

Step 6 — Enable Cloud Guard + Security Zones

Turn on:

• Cloud Guard

• Security Recipes

• Threat Detection

This gives you alerts when something is misconfigured or suspicious.

4. Architecture Diagram

(Image will be generated in next message)

Placeholder:

5. Best Practices

• Always restrict SSH by IP

• Always use NSGs instead of Security Lists

• Never expose DB services publicly

• Use Bastion instead of public VMs

• Enable automatic OS updates

• Use Vault for private keys

• Use Cloud Guard for continuous monitoring

6. Common Errors / Troubleshooting

7. Summary

With these steps, your Always Free Tier network becomes secure, structured, and production-ready — even though it costs you $0/month.

If you're a beginner or small business owner building your first OCI environment, this is the safest and simplest setup.

👉 Download the free guide: “7 OCI Networking Mistakes to Avoid”
https://dmcloudarchitect.com/c/7_oci_mistakes_to_avoid.html