OpenBSD tutorial demonstrates SSH access restricted to WireGuard VPN peers only

The tutorial describes a configuration that restricts SSH access to clients authenticated via WireGuard. This shifts the security boundary from the public internet to the VPN tunnel, effectively hiding the SSH port from unauthenticated scans. The change is transparent to SSH itself; the daemon continues to listen on its usual port, but only WireGuard peers can reach it. This reduces log noise from brute-force attempts without altering SSH’s authentication mechanisms.

WireGuard’s public-key authentication eliminates the need for static client IP addresses. Each peer is identified by its cryptographic key rather than its network address, so dynamic IP changes from ISPs no longer require firewall updates. The configuration maps WireGuard IPs to public keys, allowing the server to accept traffic only from pre-authorised peers. This simplifies remote access for users with changing IPs, such as those on mobile or residential connections.

OpenBSD’s kernel-level WireGuard support ensures the VPN operates with minimal overhead. The tutorial leverages this by configuring WireGuard as a network interface, allowing standard firewall rules to filter traffic before it reaches SSH. This avoids the latency and complexity of user-space VPN solutions, making the setup suitable for low-resource environments. However, the approach requires maintaining WireGuard key pairs and peer configurations, adding operational overhead compared to simple IP-based firewall rules.

The solution stops working if WireGuard itself is compromised or misconfigured. A misconfigured peer list or leaked private key could expose SSH to unauthorised access, bypassing the intended security boundary. Additionally, the setup does not protect against attacks from within the VPN, such as compromised client machines. Engineers must ensure WireGuard keys are securely stored and rotated, as their compromise would grant access equivalent to a stolen SSH private key.