Zero-Trust Cloud Perimeters with WireGuard Mesh and Ephemeral Bastions

Leaving SSH port 22 open to the public internet—even protected by key authentication or fail2ban—remains one of the most common vectors for automated scanning, brute-force exploits, and zero-day privilege escalations. In a modern cloud architecture, management interfaces should be completely invisible to the outside world.

Zero-trust perimeter architecture dictates that no host is trusted by default, regardless of its IP address. By combining point-to-point WireGuard cryptographic meshes with ephemeral, single-session bastion credentials, we can completely close all management ports on public interfaces.

Architectural Model: Invisible Nodes and Cryptographic Gateways

Instead of opening SSH to 0.0.0.0/0 or managing clunky VPN concentrators, we adopt an ephemeral mesh topology:

1. Public Interface Hardening: nftables or iptables drops all incoming packets on eth0 except for established connections and WireGuard UDP port 51820.
2. Ephemeral Bastion Coordinator: Engineers authenticate against an OpenID Connect (OIDC) identity provider. Upon successful MFA verification, an automated coordinator registers their workstation WireGuard public key for exactly 60 minutes.
3. Cryptographic Mesh Access: Internal SSH, metrics scraping, and database administration occur strictly over private 10.200.0.0/16 WireGuard addresses.

Enforcing Public Ingress Lockdown with nftables

On each production VPS, we configure nftables to guarantee that no internal service is reachable over public interfaces:

#!/usr/sbin/nft -f
flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        # Allow established and related connections
        ct state established,related accept

        # Allow loopback traffic
        iifname "lo" accept

        # Drop invalid packets immediately
        ct state invalid drop

        # Public Services on eth0: Only HTTPS and WireGuard
        iifname "eth0" tcp dport 443 accept
        iifname "eth0" udp dport 51820 accept

        # Management on wg0: Allow SSH only from authenticated mesh
        iifname "wg0" tcp dport 22 accept
        iifname "wg0" tcp dport 9100 accept # Prometheus Node Exporter
    }
    chain forward {
        type filter hook forward priority 0; policy drop;
    }
    chain output {
        type filter hook output priority 0; policy accept;
    }
}

Applying this rule immediately closes port 22 on public IPv4 and IPv6 addresses. Port scanners running masscan or nmap see port 22 as filtered or closed, reducing attack surface to zero.

Ephemeral Peer Registration Script

When an authorized engineer logs in via the Netbay CLI, their local public key is injected onto the fleet coordinator with an automatic TTL:

#!/usr/bin/env python3
import subprocess
import time
import sys

def grant_access(peer_pubkey: str, assigned_ip: str, duration_sec: int = 3600):
    print(f"Adding ephemeral peer {peer_pubkey} with IP {assigned_ip} for {duration_sec}s")
    
    # Add peer to running WireGuard interface
    subprocess.run([
        "wg", "set", "wg0",
        "peer", peer_pubkey,
        "allowed-ips", f"{assigned_ip}/32"
    ], check=True)
    
    # Schedule removal after duration
    time.sleep(duration_sec)
    print(f"Expiring access for peer {peer_pubkey}")
    subprocess.run([
        "wg", "set", "wg0",
        "peer", peer_pubkey,
        "remove"
    ], check=True)

if __name__ == "__main__":
    if len(sys.argv) < 3:
        sys.exit(1)
    grant_access(sys.argv[1], sys.argv[2])

Expand

Video Guide on High Availability Network Security

Watch this architectural deep dive exploring zero-trust perimeter implementations and access control patterns:

Eliminating static bastion IPs and public SSH ports provides bulletproof perimeter security while simplifying access workflows for developers.

Launch private, isolated Linux VPS instances on Netbay with hardware-level network firewalls and private IP routing at netbayhosts.in.