WireGuard

WireGuard moves SSH and NoMachine off the public zone without turning the host into a full-tunnel Internet gateway. The router forwards one UDP listener to Rocky Linux. firewalld's public zone accepts that listener but not management services; authenticated tunnel traffic enters a dedicated WireGuard zone that permits SSH and NoMachine. The services then apply independent authentication boundaries: SSH uses public key plus TOTP, while NoMachine uses system password plus TOTP.

Route and exposure decisions

The tunnel subnet must not overlap local networks, corporate VPNs, container networks, or Kubernetes networks. Client AllowedIPs are restricted to destinations that need the tunnel. Console or another trusted access path is preserved while removing management services from the public zone.

A successful handshake is one observation; zone assignment, routed traffic, service reachability and authentication need their own checks. A fresh SSH transport must complete key plus TOTP, and a fresh NoMachine client must complete password plus TOTP before any recovery session is closed. Public exposure is assessed separately through active firewall policy and the external traffic path.

Persistence is also specific to the component being checked. A tunnel returning after reboot does not establish that every application's firewall behavior preserves the administration boundary. Explicit NoMachine firewall ownership prevents the graphical service from managing that policy automatically; runtime rules still need inspection after service and host lifecycle changes.

Competing VPN routes

Cisco Secure Client on macOS can replace or remove routes. After it disconnects, WireGuard destinations should use the WireGuard tunnel interface while the server's LAN address follows the normal Wi-Fi route. Cycling the WireGuard client rebuilds a missing tunnel route. Permanent manual host routes are avoided because they conceal which VPN owns a route and can be wrong on another network.

This boundary keeps private administration away from public ingress, but it does not replace careful router, firewall, route-table, SSH-authentication, or NoMachine-authentication validation.