SSH Backdoor
Each server should have a public, DDoS filtered IPv4 address and a hidden, unfiltered IPv4 address. The DDoS filtered IPv4 address should be used for receiving and sending packets for public services. The unfiltered IPv4 address should only allow ICMP packets, ssh, ntp packets, and outbound DNS.