Bind Redis to a private interface

The fix/etc/redis/redis.conf

bind 127.0.0.1 -::1

If application servers connect over a private network, bind that address explicitly instead of loopback:

bind 127.0.0.1 10.0.0.5 -::1

Then restart:

sudo systemctl restart redis-server    # Redis
sudo systemctl restart valkey          # Valkey

Why it matters

This is the single most important line in the file. Redis’s security model assumes the network already excludes untrusted clients — authentication is described in its own docs as “a layer of redundancy” for when the network control fails, not as the primary defence.

That framing is correct, and it inverts the usual instinct. A password on a publicly reachable Redis is a speed bump: Redis serves queries fast enough that an attacker can test an enormous number of passwords per second, and the AUTH command is sent in the clear unless you have TLS. A Redis that cannot be reached needs no password to be safe.

Bind first. Everything else on this list is defence in depth behind it.

The leading dash is not a typo

bind 127.0.0.1 -::1 — the - prefix marks an address as optional. Without it, Redis refuses to start if that address cannot be bound. With it, Redis starts anyway and logs a warning.

This matters for IPv6: on a host with IPv6 disabled, bind 127.0.0.1 ::1 fails at startup, while bind 127.0.0.1 -::1 starts cleanly. It is a startup-robustness flag, not a security one — but it’s the difference between a config that works everywhere and one that breaks on half your fleet.

Binding is not the same as firewalling

A private-network bind still accepts connections from everything on that network, including every other tenant, container, or compromised host that can route to it. On a cloud VPC that can be a large blast radius.

Bind narrows the interface; a firewall narrows the source. They’re different controls and you generally want both.

Verify it worked

Check what is actually listening, not what the file says:

sudo ss -lntp | grep -E 'redis|valkey'

Expect 127.0.0.1:6379 — and specifically not 0.0.0.0:6379 or *:6379, either of which means every interface.

Confirm against the running server, in case a CONFIG SET diverged from the file:

redis-cli CONFIG GET bind

Then prove it from another host — this should fail:

redis-cli -h your.host PING

A timeout or connection refused is the result you want. PONG means the port is reachable and you should treat the instance as compromised until proven otherwise — see Redis exposed to the internet.

Before you apply this

This will disconnect application clients that connect over a public or non-bound address. That is the entire point, but it means the change is an outage for anything you miss.

Before restarting, find out who is actually connected:

redis-cli CLIENT LIST | awk '{print $2}' | cut -d= -f2 | cut -d: -f1 | sort -u

Every address in that list must be able to reach the interface you’re about to bind to, or that client breaks. Check it against your app servers’ private addresses before you commit.

Note that bind requires a restart, not a reload — Redis cannot move a listening socket at runtime.

Related

• Require authentication with ACL users — the redundancy layer behind this one.
• Redis exposed to the internet — what this closes.