stop exposing ports which make no sense on random ports
add private IP ranges to whitelist
run as root