Open a WireGuard tunnel to the server

The server is hardened, but SSH still answers the whole internet. This page builds the private path that will replace it: WireGuard on the server, on a single UDP port, and your Mac connected to it with a key generated on each device. At the end, ssh cave goes through the tunnel. The old door stays open for the whole page: it only closes on page 2, once the tunnel is proven.

Before you start

$ssh vps 'test -x /usr/sbin/ufw && echo ready'

ready

Install WireGuard on your Mac

Install WireGuard from the Mac App Store (publisher: WireGuard Development Team). Open it, then + at the bottom left → Add Empty Tunnel…. Name it cave. The app generates a key pair and shows the public key at the top of the editor.

Copy that public key into the Mac public key field of the values panel, then save the tunnel as it is. It is incomplete: part 3 finishes it. macOS asks to allow adding a VPN configuration: accept.

Install WireGuard on the server

In your ssh vps session, install the tools and generate the server's key into a file only root can read:

$sudo apt update && sudo apt install -y wireguard-tools
$sudo install -d -m 700 /etc/wireguard
$sudo sh -c 'umask 077 && wg genkey > /etc/wireguard/wg0.key'

Write the server configuration

Create /etc/wireguard/wg0.conf with sudo vim:

[Interface]
Address = 10.66.0.1/24
ListenPort = 51820
PostUp = wg set %i private-key /etc/wireguard/%i.key
[Peer]
# mac
PublicKey = ${MAC_WG_PUBKEY}
AllowedIPs = 10.66.0.2/32

Then restrict its mode: sudo chmod 600 /etc/wireguard/wg0.conf.

Open the port and start

Open the UDP port in the firewall, start the interface and have it come back on every boot, then print the server's public key:

$sudo ufw allow 51820/udp
$sudo systemctl enable --now wg-quick@wg0
$sudo wg show wg0 public-key

Copy the key it prints into the Server public key field of the values panel.

$ssh vps systemctl is-active wg-quick@wg0

active

Connect the Mac

In the WireGuard app on the Mac, select the cave tunnel, Edit. Keep the first line PrivateKey = … and add this below it:

Address = 10.66.0.2/32
[Peer]
PublicKey = ${SERVER_WG_PUBKEY}
AllowedIPs = 10.66.0.1/32
Endpoint = 203.0.113.10:51820

Save, then Activate. From a terminal:

$ping -c 3 10.66.0.1 | grep -o '3 packets received'

3 packets received

Go through the tunnel

Add an ssh shortcut on your Mac that targets the server's tunnel address, then connect with it:

$touch ~/.ssh/config && chmod 600 ~/.ssh/config
$grep -q '^Host cave$' ~/.ssh/config || printf '\nHost cave\n  HostName 10.66.0.1\n  Port 1234\n  User ops\n  IdentityFile ~/.ssh/id_ed25519_vps\n  IdentitiesOnly yes\n  AddKeysToAgent yes\n  UseKeychain yes\n' >> ~/.ssh/config
$ssh cave echo via-wireguard

ssh does not know this address yet and asks you to confirm the host key. Before answering yes, compare the fingerprint it shows with the server's, read through the old door:

$ssh vps ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

$ssh cave echo via-wireguard

via-wireguard

Done

Next page: Close the public door. It takes 1234/tcp off the internet, keeps SSH on the tunnel only, and proves everything comes back after a reboot.