A Private Droplet on DigitalOcean has no public network interface and cannot be reached directly from the internet. The standard access pattern uses a bastion host (jump host) — a regular Droplet with a public IP in the same VPC — combined with Cloud Firewalls that restrict SSH access to only the necessary paths. The tutorial covers creating a Private Droplet with `doctl` using `--enable-public-networking=false`, setting up a bastion Droplet in the same VPC, configuring two Cloud Firewalls (one allowing SSH only from your IP to the bastion, another allowing SSH only from the bastion to the private Droplet), and finally connecting via `ssh -J` ProxyJump through the bastion.
Table of contents
What a Private Droplet actually isPrivate Droplet’s ArchitectureWhen to use a Private DropletPrerequisitesStep 1 — Create the Private DropletStep 2 — Create the bastion hostStep 3 — Add a Cloud Firewall to the bastionStep 4 — Add a Cloud Firewall to the Private DropletStep 5 — ConnectQuick Verification ChecklistFurther reading374 Impressions