I’m hosting an email server on a VPS that has fail2ban in it. A lot of ports are open but only wireguard and knockd are listening.
For remote server management, I would use wireguard for regular ssh access, but when I need to configure the wireguard I can just disable/reenable the wireguard-only ssh firewall rule using port knocking, there is also the option of using the serial console on the VPS web ui but it is slower.
Honestly, I’m not sure myself if my public facing services face a DoS attack. Well, there’s always an option of using Cloudflare. With that being said though, I think in your case you should just use a free “VPN” like Tailscale or ZeroTier.
I’m hosting an email server on a VPS that has fail2ban in it. A lot of ports are open but only wireguard and knockd are listening.
For remote server management, I would use wireguard for regular ssh access, but when I need to configure the wireguard I can just disable/reenable the wireguard-only ssh firewall rule using port knocking, there is also the option of using the serial console on the VPS web ui but it is slower.
Honestly, I’m not sure myself if my public facing services face a DoS attack. Well, there’s always an option of using Cloudflare. With that being said though, I think in your case you should just use a free “VPN” like Tailscale or ZeroTier.