Hiding Administrative Ports by Securing Access with a WireGuard VPN

Even when you implement SSH keys, Two-Factor Authentication, and strong firewall rules, exposing administrative ports directly to the public internet always carries inherent risk. Every exposed service, whether it is SSH (port 22), a database administration panel like phpMyAdmin, or an internal monitoring dashboard, is a potential target for zero-day exploits and automated scanners.

The most secure architecture for a VPS or dedicated server is to completely hide these administrative interfaces from the outside world. By installing a Virtual Private Network (VPN) directly on your server, you can securely tunnel into the environment. Once connected, your local computer acts as if it is physically on the same network as the server, allowing you to interact with services bound securely to localhost without ever exposing them to the public internet.

The Advantage of WireGuard

Historically, setting up a VPN with OpenVPN or IPsec was a complex, fragile process. WireGuard is a modern, exceptionally lightweight VPN protocol that is now built directly into the Linux kernel.

It uses state-of-the-art cryptography (Curve25519) and operates completely silently. Unlike other services, a WireGuard server does not respond to unauthenticated packets. If an attacker scans your server's public IP address, the WireGuard port appears completely "stealthed" or closed, making it incredibly difficult to detect or target.

Installing and Generating Cryptographic Keys

WireGuard relies on a public/private key pair mechanism, operating very similarly to SSH keys, to authenticate clients and encrypt the tunnel.

• Connect to your server via SSH as a user with sudo privileges.

• Update your package lists and install the software by running: sudo apt update && sudo apt install wireguard.

• Navigate to the WireGuard configuration directory: cd /etc/wireguard/.

• Generate the server's private and public keys and set the correct file permissions simultaneously: umask 077 && wg genkey | tee server_private.key | wg pubkey > server_public.key

• You can view your newly generated private key (which you will need for the configuration file) by running cat server_private.key.

Configuring the Server Interface

With the keys generated, you must define the VPN's network interface (usually named wg0). This configuration dictates what virtual IP address the server will use and what port it will listen on.

• Create and open a new configuration file using your text editor: sudo nano /etc/wireguard/wg0.conf.

• Define the [Interface] block for the server:

  Plaintext

   

  [Interface]
  PrivateKey = YOUR_SERVER_PRIVATE_KEY_HERE
  Address = 10.8.0.1/24
  ListenPort = 51820
  

• Address: This assigns the server the internal, private IP address of 10.8.0.1 within the VPN tunnel.

• ListenPort: The standard UDP port WireGuard uses to accept incoming encrypted connections.

Adjusting the Firewall to Hide SSH

Once the VPN is active, the goal is to force all administrative traffic through the tunnel. This means reconfiguring your UFW firewall to allow the VPN connection, while blocking public access to standard admin ports.

• First, open the specific UDP port required for WireGuard to establish the encrypted tunnel: sudo ufw allow 51820/udp

• Next, allow incoming traffic specifically from the VPN subnet (10.8.0.0/24) to access your SSH port: sudo ufw allow from 10.8.0.0/24 to any port 22

• Start and enable the WireGuard interface so it boots automatically with the server: sudo systemctl enable wg-quick@wg0 sudo systemctl start wg-quick@wg0

• Crucial Step: Once you have successfully configured a client device to connect to the VPN and verified you can access the server via its new internal IP (ssh user@10.8.0.1), you can safely delete the UFW rule that allows public SSH (sudo ufw delete allow 22/tcp).

Your server is now essentially invisible to brute-force SSH attacks, as the port simply does not exist to the outside internet.