Remote access without opening admin consoles to the internet

remote-access-wireguard — Remote access without opening admin consoles to the internet

Every admin console reachable only from the office network or over WireGuard, and a tested way back in when the firewall locks me out.

My own lab in the Fraser Valley: two Linux servers on a business internet connection, plus a laptop and a phone that need to reach them from anywhere. Two admin consoles had been reachable from the internet.

• Set up a WireGuard VPN on the front server, with one key per device.
• Made the password vault, the file shares, the private cloud files and every admin page reachable only from the office network or the VPN.
• SSH accepts keys only, on non-standard ports.
• Moved the VPN’s forwarding rule into the part of the firewall that survives a reload.

• Found a stray line in the firewall rules that made every reload switch the firewall off. Removed it, then reloaded and confirmed the rules were active.
• Locked myself out for real: an audit sweep of my own site, from my own address, set off the intrusion filter. The VPN was the way back in, and the unban is now one written-down command.

• WireGuard
• ufw
• nginx allow-lists
• SSH keys
• CrowdSec