hairpin-nat-makes-vps-self-port-tests-unreliable

Running curl VPS_PUBLIC_IP:PORT from within the VPS hairpins locally and bypasses the cloud firewall and iptables external path — the result is NOT representative of what an external client sees. To genuinely verify external exposure, test from a machine outside the VPS (e.g., laptop or external curl). Hairpin test showing a response does NOT mean the port is open to the internet.