SSH Port 22: 50,000 Attacks Daily
A dedicated server with default port 22 open receives ~50,000 brute force attempts daily. Even with Fail2ban, log files reach 1GB, 10% CPU wasted parsing attacks.
Solution: Hide SSH from internet entirely. Access only via VPN.
Zero-Exposure SSH: Internet → VPN port 51820 → Private Network 10.8.0.0/24 → SSH port 22 → Server. SSH closed to internet, only VPN network access.
Setup: 1) Install WireGuard on cloud server. 2) Firewall: `ufw deny 22/tcp; ufw allow from 10.8.0.0/24 to any port 22; ufw allow 51820/udp`. SSH now internet-closed.
Bastion Host: 20 servers, 5 admins → Single jump server. Admins SSH to bastion (via VPN) → then to production servers. Centralized logging.
MFA: Layer 1 VPN connection (WireGuard key), Layer 2 SSH login (key + TOTP). Stolen laptop useless without TOTP.
Monitoring: Integrate VPN + SSH logs. Alert: VPN connection=no but SSH attempt=yes → attack! Daily summary to corporate email SIEM.
Performance: WireGuard adds ~1-2ms latency (imperceptible). SCP throughput: Direct 1Gbps, WireGuard 950Mbps (5% overhead). Security gain justifies overhead.
Multi-Region: Sofia 3 servers + Istanbul 5 servers. WireGuard mesh: each region VPN gateway, admin connects once, SSH access both regions.
Disaster Recovery: Primary VPN down → Secondary VPN gateway (failover DNS) or Emergency SSH (specific admin IP whitelist).
Compliance: PCI-DSS 2.3 (MFA for admin access), ISO 27001 A.9.4.2 (secure log-on). VPN + SSH + MFA satisfies requirements.
Cost-Benefit: Without VPN: Fail2ban 10% CPU, 30GB logs/month, high risk. With VPN: Cloud server €40/month, 0% Fail2ban CPU, 500MB logs, zero brute force risk. VPN economical for 20+ servers.
EuroVDC manages domain + server + VPN from single panel. SSH security increases 99.8%.